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SECTION I. 

INTRODUCTORY 

Paragraph 



Preliminary remarks ; 1 

General remarks upon the nature of cryptographic periodicity '2 
Effects of varying the length of the plain-text groupings . . 3 
Primary and secondary periods; resultant periods . 4 



1. . Preliminary remarks. - a_. The text immediately preceding this 
devoted itself almost exclusively to polyalphabet ic substitution systems 
of the type called repeating-key ciphers. It was seen how a regularity in 
the employment of a limited number of alphabets results in the manifestation 
of periodicity or cyclic phenomena in the cryptogram, by means of which the 
latter may be solved. .The difficulty in solution is directly correlated 
with the type and number of cipher alphabets employed in specific examples. 

_b. Two procedures suggest themselves for consideration when the 
student cryptanalyst realizes the foregoing circumstances and thinks of 
methods to eliminate .the weaknesses-' inherent in this cryptographic system. 
First, noting that the difficulties in solution increase as the length of 
the key increases, he may study the effects of employing much longer keys 
to see if one would be warranted in placing much trust in that method of in- 
creasing the security of the messages. Upon second thought, hoxvever, remem- 
bering that as a general rule the first step in the solution consists in 
ascertaining the number of alphabets employed, it seems to him that the 
most logical thing to do would be to use a procedure which will avoid 
periodicity altogether, will thus eliminate the cyclic phenomena that are 
normally manifested in cryptograms of a periodic construction, and thus 
prevent an enemy cryptanalyst from taking even a first step toward solution. 
In other words, ho will . investigate the possibilities of aperiodic systems 




REF ID:A4146453 

2 

first and if the rosults are unsatisfactory, ho will then see what he can 
do with systems using lengthy keys, 

c_. Accordingly, the first part of this text will be dovoted to an 
examination of certain of the very simple varieties of aperiodic, polyalpha- 
betic substitution systems; after this, methods of extending or lengthening 
short mnemonic keys, and systems using lengthy keys will be studied, 

2, General remarks upon the nature of cryptographic periodicity, - eu 
When the thoughtful student considers the matter of periodicity in poly- ' 
alphabetic substitution systems and trios to ascertain its real nature, ho 
notes, with some degree of interost and surprise perhaps, that it is composed 
of two fundamental factors, because there aro in reality two elements involved 
in its production. Ho has, of courso, become quite familiar With the idea 
that periodicity necessitates the use ( of a koying element and that the latter 
must be employed in a cyclic manner. But he now begins to realize that there 
is another element involved, the significance of which he has perhaps not 
fully appreciated, viz , that unless the key is applied to constant-length 
plain- text groups no periodicity will be manifested externally by the. cryp- 
togramr despite the repetitive or cyclic use of a constant-length key. This 
realization is quickly followed by the idea that possibly all periodicity 
may be avoided or suppressed by either or both of two ways; (1) by using 
const ant -length keying units to encipher variable-length plain- text groupings 
or (2) by using variable-length keying units to encipher constant-length 
plain-text groupings. 

b. The student at once realizes also that the periodicity exhibited 
by repeating-key ciphers of the type studied in the preceding text is of a 
very simple character. There, successive letters of the repetitive key were 
applied to successive letters of the text. In respect to the employment of 
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the key, the cryptographic or keying process may be said to be constant or 

• I ' ' 

fixed in character. This terminology remains true even if a single keying 

i . • 

unit serves to encipher two or more letters at a time, provided only that 
the groupings of plain-text letters are constant in length. For example, a 
single keyletter may serve to encipher two successive plain- text letters; if 
the key is repetitive in character and the message is sufficient in length, 
periodicity will still be manifested by the cryptogram and the latter can 
be solved by the methods indicated in the preceding text. 1 ' Naturally, those 
methods would have to be? modified in accordance with the specific type of 
grouping involved. In this caso the factoring process would disclose an 
apparent key length twice that of the real length. But study of the frequency 
distributions would soon show that the 1st and 2d distributions were similar, 
the 3d and 4th, the 5th and 6th, and so on, depending upon the length of the 
key. The -logical step is therefore .to combine the distributions in proper 
pairs and proceed as usual. 

c_. In all such cases of encipherment by constant-length groupings, 
the apparent length of the period (as found by applying the factoring process 
to the cryptogram) is a multiple of the real length and the multiple corres- 
ponds to the length of the groupings, that is, the number of plain-text 
letters enciphered by the same keyletter. 

d_. The point to be noted, however, is that all these cases are still 
periodic in character, because both the keying units and the plain-text 
groupings are constant in length. 

3. Effects of varying the length of the plain-text groupings. - a_. 

But now consider the effects of making one or the other of these two elements 
variable in length. Suppose that the plain-text groupings are made variable 

l In this connection, see Section 3, Military Cryptanalysis, Part II. 
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in length and that the keying units are kept constant in length. Then, 
even though the key may be cyclic in character and may repeat itself many 
times in the course of enciphorment, external periodicity is suppressed, 
unless the law governing the ' variation in plain-text groupings is itself 
cyclic in character. and the length of the message is at. least two or more 

1 ' ' *" "" "" ' * — " 1 " 11 — . 1 1 i* 1 “ " 1 " ■ 

times that of the cycle applicable to this variable grouping . 

b_. (1) For example, suppose the correspondents agree to use reversed 

standard cipher alphabets with the .keyword SIGNAL, to encipher a message, 
the latter being divided up into groups as shown below: 
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Cryptogram. 
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Figure 1 
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(2) The cipher text in this example (Fig. 1) shows a- tetragraphic 
and a pentagraphic repetition. The two occurrences of QUWUG [» COMMA) are 
separated by an interval of 90 letters; the two occurrences of ARQU (;?IRST) 
by 39 letters. The former repetition ( QUWUG) , it will be noted, is a true 
periodic repetition, since the plain-text letters, their grouping, and the 
keyletters are identical. The interval in this case, if counted in terms 
of letters, is the product of the keying cycle, 6, by the grouping cycle, 15 
The latter repetition, (ARQN), is not a true periodic repetition in the 
sense that both cycles have been completed at the same point, as is the case 
in the former repetition. It is true that the cipher letters ARQN, repre- 
senting IRST both times, are produced by the same keyletters, I and G, but 
the enciphering points in the grouping cycle are different in the two cases, 
Repetitions of this type may bo termed p art ialiy-pe riod ic repetitions, to 
distinguish them from those of the complotely-por i odic type'. 

£. When the intervals between the two repetitions noted above are 
more carefully studied, especially from the point of view of the interacting 
cycles which brought them about, it will be seen that counting according to 
groupings and not according to single letters, the two pentagraphs QUWUG 
are separated by an interval of 30 groupings. Or, if one prefers to look 
at the matter in the light of the keying cycle, the two occurrences of QUWUG- 
are separated by 30 key letters. Since the key is but 6 letters in length, 
this means that the key has gone through 5 cycles. Thus, the number 30 is 
the product of the number of letters in the keying cycle (6) by the number 
of different-length groupings in the grouping cycle (5). The interaction 
of these two cycles may be conceived of as partaking of the nature of two 
gears which are in mesh, one driven by the other. One of these gears has 6 
teeth, the other 5, and the teeth are numbered. If the two gears are ad- 
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justed so that the"number 1 teeth" are adjacent to each other, and the gears 
aro caused to revolve, these two teeth will not come together again until 
the larger gear has made 5 revolutions and the smaller one 6, During this 
time, a total of 30 meshings of individual teeth will have occurred. But 
since one revolution of the smaller gear (»the grouping cycle) represents 
the encipherment of 15 letters, when translated in terms of letters, the 
6 complete revolutions of this gear mean the encipherment of 90 letters,. 

This accounts for the period of 90, when stated in terms of letters. 

<1. The two occurrences of the other repetition, ARQN, are at an inter- 
val of 39 letters ; but in terms of the number of intervening groupings, the 
interval is 12, which is obviously two timeb/the -length of the keying 
cycle. In other words, the key has in this case passed through 2 cycles. 

In a long message enciphered according to such a scheme as the 
foregoing there would be many repetitions of both types discussed above 
(the completely -periodic and tho partially-periodic ) so that the cryptanalyst 
might encounter some difficulty in his attempts to reach a solution, especi- 
ally if he had no information as to the basic system. , It is to be noted in 
this connection that if any one of the groupings oxcoeds- say 5, 6, or 7 
letters in length, the scheme may give itself away rather easily, since it 
is clear that within each grouping the encipherment is strictly monoalpha- 
betic . Therefore, in the event of groupings of more than 5 or 6 letters, 
the monoalphabet ic equivalents of tell-tale words such as ATTACK, BATTALION, 
DIVISION, etc., would stand out. The system is most efficacious, therefore, 
with short groupings. 

_ f_. It should also be noted that there is nothing about the scheme 

which requires a regularity in the grouping cycle such as that embodied in 
the example. A lengthy grouping cycle such as the one shown below mby just 
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“ ( *“ 

as easily be employed, it being guided by a key of its own; for example, 

the number of dots and dashes contained in the International Morse signals 

for the letters composing the phrase DECLARATION OF INDEPENDENCE might be 

used. Thus, A ( ,~)has 2, B (— ...} has 4, and so on. Hence: 

DEC LA. RATIONOF INDEPENDENCE 
3144232123234 2 23141 2 31241 

The grouping cycle is 3 + 1 4- 4 +4 f-2 or 60 letters in length. Suppose 

the same phrase is used as an enciphering key for determining the selection 

of cipher alphabets. Since the phrase contains 25 letters, the complete 

the least common multiple of 

period of the system would be/25 and 60 or. 300 letters. This system might 

appear to yield a very high degree of cryptographic security. But the 

student will see as he* progresses that the security is not so high as he' 

may at first glance suppose it to be. 

4. • Primary and secondary periods; resultant periods. - a. It has 

been noted that the length of the complete period in a system such as tho 

common multiple 

foregoing is tho least/ of the length of the two component or interacting 
periods. In a way, therefore, since the component periods constitute the 
basic element of the scheme, they may be designated as the basic or prim ary 
periods. These are also hidden or l atent periods. The apparent o r patent 
period, that is, the complete period, may be designated as the secondary . 
or resultant period. In certain types of cipher machines, there may be more 
than two primary periods, which interact to produce a resultant period; also, 
there are cases in which tho latter may interact with another primary period 
to produce a - tertiary period; and so on. Hie f inal’ , or resultant , or apparent 
period is the one which is usually ascertained first as a result of the study 
of the intervals between repetitions.; This may or may not be broken down 
into its component primary periods. ; 

_b. Although a solution may often be obtained- without breaking down a 
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resultant period into its component primary periods, the reading of many 
messages pertaining to a widespread system of secret communication is much 
facilitated when the analysis is pushed to its lowest level, that is, to 
the point where the final cryptographic scheme has been reduced to its 
simplest terms. This may involve the discovery of a multiplicity of simple 
elements which interact in successive cryptographic strata. 

SECTION II 

SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS 
TO. ENCIPHER VAEIABLE*LEl'IGTIl PULl-A[EXT GSGt^IFSGS , I 

..•> r ••••! , Paragraph 



Introductory remarks 5 

Aperiodic ..encipherment produced by groupings according to . 

word lengths 6 

Solution when direct standard, cipher alphabets are employed ..... . . 7 

Solution when reversed standard cipher alphabets are employed .... 8 

Comments on foregoing cases 9 



5. Introductory remarks. - a_. The system described in Par. 3 above 
is obviously not to be classified as aperiodic in nature, despite the injec- 
tion of a variable factor which in that case was based upon irregularity in 
the length of one of, the two elements involved in polyalphabet ic substitu- 
tion. The. variable factor was there subject to a law which in itself was 
periodic in character. 

b_. . To make such a system truly aperiodic in character, by elaborating 
upon the basic scheme for producing variable-length plain- text groupings, 
would.be possible, but impractical. For example, using the same method as 
is given in -Par. 3f- for determining the lengths of the groupings, one might 
employ the text of .a book; and if the latter. is longer than -the message to 
be enciphered, the cryptogram would certainly show no periodicity as regards 
the intervals between repetitions, which would be plentiful. However, as 
already indicated, such a scheme would not be very practical for regular 
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communication between a large number of correspondents, for reasons which 
are no doubt apparent. The' book would ’have to be safeguarded as would a 
code; enciphering and deciphering would be quite slow, cumbersome, and sub- 
ject, to error; and, unless the same key-text were .used for all messages, 
methods or indicators would have to be adopted to show exactly where encipher 
ment begins in each message. A simpler method for producing constantly 
changing, aperiodic plain-text groupings therefore, is to be sought. 

- 6. ' Aperiodic encipherment, produced by groupings according to word 

lengths. -: a_. The simplest method for producing aperiodic plain-text group- 

\ ^ 

ings is one 'which has doubtless long ago presented itself to the student, 
viz , encipherment according to the actual word lengths of the message to be 
enciphered. 

b_. Although the average number of letters composing the words of any 
alphabetical language is fairly constant, successive words comprising plain 
text vary a great deal in this respect, and this variation is subject to no 
law. In telegraphic English, for example, the mean-length of words is 5.2 
letters; the words may contain from one to 15 or more .letters, but the succes 
sive words vary in length in an extremely irregular manner, no matter how 
long the text may be. 

c_. As a consequence, the use of word lengths for. determining the 
number of- letters to be enciphered by each koylettor of a repetitive key '• 
commends itself to the inexperienced cryptographer as soon as he comes to 
understand the way in which repeating-key ciphers are solved. If there is 

1 It is true, of course, that the differences between two writers in ..res- 
pect to the lengths and characters of the words contained in their personal 
vocabularies are of ten marked, and can be measured. These differences may be 
subject to certain laws, but the latter are not of the type in which we are 
interested, being psychological rather than mathematical in character. See 
Rickert, E., Hew Methods for the Study of Literature: , University of Chicago 
Press, Chicago, 1927. 
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no periodicity in the cryptograms, how can tho letters of the cipher text, 
written in 5-letter groups, he distributed into their respective mono alphabets 
And if this very first step is , impossible, how con the cryptograms be solved? 

7. Solution when direct standard cipher alphabets are employed. :- a_. 
Despite the foregoing rhetorical questions, the solution of this case is 
really quite, simple. It merely involves. a. modification of the method given 
in a previous text , wherein solution of a.monoalphabetic cipher employing a 
direct standard alphabet is accomplished by completing the plain-component 
sequence... There, all the words of the entire message come: out on. a single 
generatrix of the completion diagram. In the present case, since the indivi- 
dual, separate words of a message are enciphered- by different- keyletters, 
these words will , reappear on different generatrices of the diagram . 

All the cryptanalyst has to do is to pick them out. He can do this once he 
has found a good starting point, by using a little imagination and following ’•* 
clues afforded by. the context. . 

b. An . example will make the method clear. • The following, messaged note 
its- brevity) has -.been .intercepted: .... 

T R I C S. Y G-.E T I . L U V W V I K M-Q, I RX 'S.-P J ■ 

SVA-GR XUXPW VMTUC SYXSX VHRFB LLBHG v: 
c_. Submitting the message to routine study, the first stop is to use 
normal alphabet strips and tiy out the possibility of direct standard alpha- 
bets having been used. The completion diagram for tho first 10 letters of 
the message is. shown in Fig. 2. ■ • ' 

. cly Despite the fact that the text does not all reappear on the same 
generatrix, the solution' is -a very simple matter because the first three words 
of the message are easily found: CAN YOU GET. The keyletters may be sought 

• ^-Military Cryptanalysis, Part I, Par.. 20. - 




REF ID:A4146453 



- 11 - 

TEECSYGETI 
USFDTZHFUJ 
VTGEUAIGVK 
-:WUHFVBJHWL 
XVIGWCKIXM 
Y W J H X D L J Y N 
ZXKIYEMKZO 
AYLJZFNLAP 
BZMK.AGOMBQ, 

. CA-NLBHPNCR 
DBOMCIQODS 
ECPNDJRPET 
FDQOEKSQFU 
GERPFLTRG.V 
HFSQ.GMUSHW 
IGTRHNVT IX 
JHUSIOWUJY 
KIVTJFXVKZ 
LJWUKQYWLA 
MKXVLRZXMB 
N L Y W M S A Y N C 
O’M Z X N T B Z 0 D 
PNAYOUCAPE 
QOBZPVDBQF 
RPCAQWECRG 
SQDBRXFDSIi 

Figure 2, 

8. Solution when reversed standard cipher alphabets are employed.. 

It should by this time hardly bo necessary to indicate that the only change 
in the procedure' set forth in Par. 7c_,ji in the case of reversed standard 
cipher alphabets is that the letters of the cryptogram, must be converted ixit 
their plain- component (direct standard) equivalents before the completion- 
sequence is applied to the message.' 

9. Comments on foregoing cases. - a_. ' The foregoing cases are so 
simple in nature that the detailed treatment accorded them would seem hahdly 
to be warranted at this stage of study. However, they are necessary and 



in the usual manner and are found to be REA. One 
may proceed to set up the remaining letters of the 
message on sliding normal alphabets , or one may 
assume various keywords such as READ, REAL, REAM, 
etc., and try to continue the decipherment in that 
way. The former method is easier. The completed 
solution is as follows: 
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E R S . 


CAN 


YOU 


GET 


FIRST 


REGIMENT BY RADIO 


TRE 


CSY 


GET 


ILUVW 


VIKMQIRX SP JSVAG 


D 


I 


G 


. E 


S T 


OUR 


PHONE 


NOW 


OUT 


OF' COMISSION 


RXU 


XPWVM 


: tuc 


SYX 


GX VHFFBLLBHG 



e_. Note the key in the foregoing case : It 

is composed of the successive key-letters of the 
phrase READERS DIGEST. 
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valuable as an introduction to. the more complicated cases to follow. 

by Throughout this text, whenever encipherment processes are under 

discussion, the -pair of enciphering equations commonly referred to as 

characterizing the so-called Vigenere method will be understood, unless 

otherwise indicated. This method involves the pair of enciphering equations 

Q- / _ ft , "A , /a , that is, the index letter, which is usually the 
l /l jy'Oc/x • ' 

initial' letter of the plain component is set opposite the keyletter on the 
cipher component ; the plain-text letter to be enciphered is sought on the 
plain component and its equivalent is the letter opposite it on the cipher 
component.^ .. 

c_. The ■ solution of messages prepared according , to the two preceding 
'.methods is particularly easy, for tho reason that standard cipher alphabets 
are employed and these, of course, arc derived from known components. Tho 
significance of this statement should by this time be quite obvious id the 
student. , But what if mixed alphabets are employed, so that one or both of 
the components upon. which the cipher alphabets are based. are unknown, sequences 
The 'Simple procedure of. completing the plain component obviously cannot be 
used. Since the messages are polyalphabetic in character, and since the 
process of factoring cannot be applied, it, would seem that the solution of 
messages enciphered in .different alphabets and according to word lengths 
would be a rather difficult matter. However, it will soon be made clear that 
the solution is not nearly so difficult as first impression might lead the 
student to imagine. - ... 



I • 

See in this connection, Military Cryptanalysis, Part II, Section II, and 
Appendix 1. 





REF ID : A4 14 645 3 

- 14 - 



MESSAGE: ' 



X I X L P E Q V I B VEFH.APTVT'HT X W K P W E VT I f R D X M 
NTJCTYZL OAS X Y Q, ARVVRKFONT B H SFJDUUXFT 
0 U V I G J P F ULBFZ R V DKU.KW R 0 H. R 0 Z 
' IDIOMORPHIC SEQUENCES: ; 



( 1 ) 

(4) 



P W E W I W R D 
R 0 H R 0 Z 



(2) A R V V R K F 0 N T. ( 3 ) -'S F JDU U X F P " ' 





c_. Reference to lists of words commonly found in -military text and 

arranged according to their idiomorphic patterns or formulae soon gives 

suggestions for these cipher groups. Thus: 

(1) P W E W I W R D . (3) SFJDUUXFP 

;D'_I VISION " ' ' k R T I L_L E R Y 



(2) A R V V R K F 0 N T (4) R 0 H R 0 Z 

B AJT T^A L I 0 N S 0_G L 0_C K 

d_. With these assumed equivalents a reconstruction skeleton or diagram 
of cipher alphabets (forming a portion of a quadricular table) is established, 
on the. hypothesis that the cipher alphabets have been derived from the sliding 
of a mixed component against the normal sequence. First it is noted that 
since 0^* R c both in the word DIVISION and in the word OCLOCK, their cipher 
equivalents must be in the same alphabet. The reconstruction skeleton is 
then as follows: 



DIVISION, OCLOCK ,U) . 
BATTALION (2) 

ARTILLERY - (3) 



_A 
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_C 


_D 


_E_ 
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G^ 


H_ 


3^ 
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K_ 
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_N 


_0 
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_R 
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_T 


U 


_v 
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X 


_Y 


_Z 
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R 
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A 














F 






K 
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0 








T 


V 














S 








X 








D 






U 












F 




J 










P 





Figure 3a 
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e_. Noting that the interval between 0 and R 'in the first and second 
alphabets is the same, direct symmetry of position is assumed. In a few 
moments the first alphabet in the skeleton becomes as 'follows: 
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E 
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E 




•N. 
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G 
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D. 
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0 
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1 
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a 
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B 










F 




J 










P 





Figure 3b. 

f_. The keyword upon which the mixed component is based is now not 
difficult to find: HYDRAULIC. 

£. (1) To decipher the entire message, the simplest procedure is to 

convert the cipher letters into their plain-component equivalents (setting 

S 

the HYDRAULIC ...Z sequence against the normal alphabet at any point of 
coincidence)' and then completing the' plain-component sequence, as usual. The 
words' of the message will then reappear on different generatrices. The key- 
letters may then be ascertained and the solution completed. Thus, for the 
first three words, the diagram is as follows.: 
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Plain ... ABCDEFGHIJKLMHOPQRSTUI WX Y Z 
Cipher ... H Y D R A U L I C B E F G J K M N 0 P Q S T V U X Z 
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AJMXZ 
BKUYA 
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FORCE 




Figure 4. 



(2.) The key for the message is found, to be SUPREME COURT and, the 
complete message is as follows: •• ■ 











SOLUTION 
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AT SEVEN 
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BH SFJDUUXFP 


OWIGJPF 


ULBFZ 


RV DRUM 


ROHROZ 







g. In case the plain-component is the reversed normal sequence, the 
procedure- is no different from the foregoing, except that in the completion 
diagram the reversed sequence is employed after the cipher letters have been 



converted into their plain-component equivalents. 



i 
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h. • No doubt the student realizes from his previous work that onoe 

- 1 f 

the primary mixed component has been recovered the latter becomes a known 

sequence and that the solution of subsequent messages employing the same 

* * • 

set of derived alphabets, even though the keys to individual messages are 
different, then becomes a simple matter. 

11. Solution when other types of alphabets are employed. - a. The fore- 
going examples involve the use either of standard cipher alphabets or of 
mixed cipher alphabets produced by the sliding of a mixed component against 
the normal sequence. There is, however, nothing about the general crypto- 
graphic scheme which prevents the use of other types of derived, interre- 
lated, or secondary mixed alphabets. Cipher alphabets produced by the sliding 
of a mixed component against itself (either direct or reversed) or by the 
sliding of two different mixed components are very commonly encountered in 
these cases. 

b_. The solution of such cases involves only slight modifications in 
procedure, namely, those connected with the reconstruction of the primary 
components. The student should be in a position to employ to good advantage 
and without difficulty what he has learned about the principles of indirect 
symmetry of position in the solution of cases of the kind described. 

c_. The solution of a message prepared with mixed alphabets derived 
as indicated in Subpar. _b, may be a difficult matter, depending upon the 
length of the message in question. It might, of course, be almost impossible 
if the message is short, and there is no background for the application of 
the probable-word method. But if the message is quite long, or, what is, 
more probable with respect to military communications, should the system be 
used for regular traffic, so that there are available for study several 
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messages enciphered by the same sot, of alphabets, then the problem becomes 
much easier. In addition to the usual steps in solution by the probable- 
word method, guided by a search for and identification of id iomorphs, there 
is the help that c an be obtained from the use of the phenomena of isomorphism , 
a study of which forms the subject of discussion in the next paragraph. . 

12. Isomorphism and its importance in cryptanalytics. - a. The term 
idiomorphism is familiar to the student. It designates the phenomena aris- 
ing from the presence and positions of repeated letters in plain-text words, 
as a result of which such words may be classified according to their compo- 
sit ions , "patt erns ”, or formulae . The term isomo r phism (from the' Greek 
"isos" meaning "equal" and "morphe" meaning "form") designates the phenomena 
arising from the existence of two or more idiomorphs with identical formulae,. 
Two or more sequences which possess identical formulae are said to be 
isomorphic . 

j». Isomorphism may exist in plain text or in cipher text. For example, 
the three words WARRANT, LETTERS, and MISSION are isomorphic. If enciphered 
monoalphabe tic ally, their cipher equivalents would also be isomorphic. In 
general, isomorphism is a phenomenon of monoalphabcticity (either plain or 
cipher); but there are instances wherein it is latent and can be made patent 
in polyalphabet ic cryptograms. 

c_. In practical cryptanalysis the phenomena of isomorphism afford' a 
constantly astonishing source of clues and aids in solution. The alert 
cryptanalyst is always on the lookout for situations in which he can take 
advantage of these phenomena, for they are among the most interesting and 
most important in cryptanalytics. 

13. Illustration of the use of isomorphism. - a_. Let us consider the 
case discussed under Par. 10, wherein a message was enciphered with a set 
of mixed cipher alphabets derived from sliding, the keyword-mixed primary 
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component HYDRAULIC . . . XZ against the normal sequence. Suppose the message 
to be as follows (for simplicity, original word lengths are retained): 



CRYPTOCRAM 

VCLLKIDVSJ'DC I 0 R K D CFSTV I X H M P P F X U E V Z Z 

F K N A K F 0 R A DKOMP I S E C SPPH&KCLZKSQ, LPRO 

J Z W B C X HOQCFFAOX R 0 Y X A N 0 E M D M Z M T S 

T Z F V U.E A 0 R S L AU P A D D E R X P N B X A R IGHFX JXI 

b_. (1) Only a few minutes inspection discloses the following three 



sets of isomorphs: 

[U) VCLLKIDVSJDC I 
(l)-^(b) CS PP HQKCLZKSq 
(o) PADDERXPNBXAR 




I X H M P_P_ F X |FT 

HOQ. CFFAOX 

V. > 




N A K F 0 R A 

royxa.no 

V- rr 1 



(2) .Without stopping to refer to word-pattern lists in an attempt 
to identify the very striking idiomorphs of the first set, let the student 
proceed to build up partial sequences of equivalents, as though he were 
dealing with a case of indirect symmetry of position. Thus:"*" 

From isomorphs (l)(a) and (l)(b): 

V O C; COS; L O P; K O H; I O Q; D O K; SOL; J <> Z 
from which the following partial sequences are constructed: 



(a) YCSLP (b), DKH (c) IQ, (d) JZ 
From isomorphs (l)(b) and ( 1 ) { c ) : 

COP; so A; POD; H O E; QOR; K O X; L O N; Z O B; 
from which the following partial sequences are constructed: 

(e) CPD (f) SA (g) HE (h) QR (i) KX (j) LN (k) ZB 
From isomorphs (l){a) and (l)(c): 

VOP; GOA; L O D; K O E; I O R; D O X; SON; JOB 



^The symbol O is to be read "is 



equivalent to.” 
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from which the following partial sequences are constructed: 

(1) LDX (m) VP (n) CA (o) KE (p) IR (q) SN (r) JB 
Noting that the data from the three isomorphs of this set may be combined, 
(VCSLP and CPD make VCSLP.. D; the latter and LDX make VCSLP. .D. . .X) the follow 
ing sequences are established: 




c. (1) The fact that the longest of these' chains consists of exactly 

13 letters and that no additions can be made from the- other • two cases of 

isomorphism, leads to 'the' assumption that a ’'half-chain" is here disclosed 

and that • the latter represents a decimation of the original primary component 

• 123 456739 

at an even interval. Noting the placement of the letters V . S . P . N . K , 

which gives the sequence the appearance of being the latter half of a keyword- 

mixed sequence running' in the reversed direction, let the half-chain be re- 
versed and extended to 26 places, as follows: 

1 2 3 4 5 6 7 3 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

E . K H P S V X H . D ' A L • C 

(2) The data from the two partial chains (JZ..B and IQ. .R) may 

now be used, and the letters inserted into their proper positions. ■ Thus: 

1 2. 3 4 5 6 7 3 9 10 11 12 13 14 15 16 17 13 19' 20 21 22 23' 24 '25 26 

E . . J K . N . P Q S . V . X Z H . D R A . L I C B 

(3) The sequence fl . D R A . L 1 G soon suggests HYDRAULIC as the 
keyword. When the mixed sequence is then developed in full, complete corro- 
boration will be found from the data of isomorphs 2(a) (b) and 3(a) (b). Thus: 

I 2 3 4 5 6 7 3 9 10 IT. 12 13 14 15 16 17 13 19 20 21 22 23 24 25 26 
HYDRAULIC B E F G J K M N 0 P Q S'- T V W" X Z 
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Figure 7. 

b_. If, as a result of the analysis of several messages (as described 
in Par. 25), mixed primary components have been reconstructed, the solution 
of subsequent messages may readily be accomplished by following the procedure 
outlined in a above, since in that case the cipher alphabets have become known 
alphabets. ' . . 

25. Solution of cipher- text, auto-keyed cryptograms by frequency 
analysis. - a. Take the short message given in Par. 23c_(l). It happens that 
the letter R c occurs four times, and because of the nature of the system it 
also appears four times in the key. It is clear that all plain-text letters 
enciphered , by R^ must be in the same cipher alphabet; in other words, every 
cipher, letter which .immediately follows an R c in the cryptogram belongs to 
what may be designated conveniently as the R cipher alphabet. The same is 
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true of every cipher letter following an A c , a B c , a C c , and so on. In short 
if a special kind of distribution is made" of the text of a cryptogram enci- 
phered in this way, the text can be allocated into 26 uniliteral, monoalpha- 



botic frequency distributions, and the latter can then be solved by frequency 
analysis, providing there are sufficient data for the purpose in one or more 
of the distributions. 

_b. An example will serve to clarify the procedure. Suppose the follow 
ing cryptograms are at hand: ' - 



(1) USYPW/TRXDI MUIR 

B E K V B MAMMO TUB YT ■ 

PMYUC N E V V J LKZE.K 

T C V N I ID D 0, Q, E K K L R 

E F A A G Z R L F D IT DSC D ; 

ATNNB OUPIT 7 L X T C 

NiqiH U V E V Y PL qG VI 

TNKKU XLODL WTHCZ 

(2) ' B I W B F G R X L G . H 0 U Z 0 ' 

■ X R S C T K V 3 W K 0 T G U Q, 

K T T C F KVKR O B 0 E P L 

JOEYM RPEEW HOT JO 

(3) HALO Z J RR VII MHCVB 

K Z E K U ' R F R F X YBH A L 

X A G X D MCUNX .XL.XGZ 

’ BJ.NNB ITMLJ 0 0 S E A 



KVDBD D q G S U NSFBO 
E N A X M qLZIX D I X G Z 

URCNI F q F N H YGSIJ 

i 

VRFRF XROCS SJTBY 

MPBBV D E W R R NqiCH 

V' A .0 V E YJ JLK DMLEG 

UPVKU BMMLB 0 A E 0 T 
R 

L L Z IT, A MHCTY 3 C A A T 
. ,Q F J 0. C YYBVK IXDKT 

, q I G N R iqo V J YKIPH 

CRUX OZETZ-NK 

YU HAO EOVAC q V V J L 

ZOFHM RSJYL APGRS 

J P U U I FD.B BY PVFZN 

A T IC P B . S Y . ' - • 



A set of 26 distributions is now made , ' corresponding . to the 26 letters', of the 
alphabet. In each distribution a tally is entered in 'the appropriate cell to 
indicate the. cipher letter which ..immediately .follows each occurrence, of the . 
letter to which the distribution applies. 
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Key XJKYRZECSMMDWAEDDVO.S. . . 

Plain ' NOTIFYQCART E R U A ST ER . . . 

Cipher . . . K Y R Z E C S M M D W A R D D V 0 S J . . . 

(2) If a keyword is used: ; 

Key T Y P E W R I T E R) G MIMBPYNEI.. 

Plain NOTIFYQUARTERMASTER . . 

. Cipher ... G M I M B P W S I Z Q.Z Y B H R R V . . . 

(3) Sometimes only the last cipher letter resulting from the use 
of the prearranged keyword is used as the keyletter for enciphering the 
huto-keyed portion of the text. Thus, in the last example, the plain text 
beginning TERMASTER would be enciphered as- follows: 

Key T YPEWRIT E Rjl B F W I I A T X . . . 

Plain NOTIFYQUARTE.RMASTER . . . 

Cipher . . . G M I M B P Y N S I B F W I I A T- X 0 . . . 

d. In the foregoing examples, direct standard alphabets are employed; 

but mixed alphabets, either interrelated or independent* may be used just 
as readily. Also, instead of the ordinary type of cipher alphabets, one 
may employ a mathematical process of addition (see Par. 40f of Special Text 
No. 166, Advanced Military Cryptography) but. the difference between the 
latter process and the ordinary one using sliding alphabets. is more apparent 
than real. , : 

e, . Since the analysis of the case in which the cipher text . constitutes 
$ 

the auto key is usually easier than that in which the plain text serves this 
function, the former will be the first to be discussed. 

24. Solution of cipher-text auto-keyed cryptograms when known alphabet 
are employed. - a. (1) First of all it is to be noted that if the crypt- 
analyst knows the cipher alphabets which were employed in encipherment, the 
solution presents hardly any “problem at all. It -is only necessary to de- 
cipher the message beyond the keyletter or keyword portion and the initial 
part of the plain text enciphered by this keyletter or keyword can be filled 
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in from the context.. An example, using standard cipher alphabets, fellows 
herewith: 

Cipher ... . W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M P E S K D 

(2) .Writing the cipher text as keyietters (displaced one interval 
to the right) and deciphering by direct standard alphabets yields the follow- 
ing: . ' 



Key W ;S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M P E S K 

Cipher ... W S G QV'O'H V M Q W E Q U H A A L N B N ZZMP'EEKD 

Plain W0KF1T.0REGIM' E fiTILCO M M A N DP OS T 

(3) ■ Trial of the word REPORT as the initial word of the message 

yields an intelligible word as the initial-, key: FORCE, so that the message 

reads: 

Key F-'O'R'C E V O H V M Q ' " 

Cipher . . . W S G Q V 0 H V M Q . . . 

Plain ....REPO PIT TORE : ' ’ '• 



(4) A semi-automatic method of solving such a message is to use 
sliding normal alphabets ' and align the strips so that, as one progresses from 

left to right, each cipher letter is set' opposite- the letter A on the. preceding 

/ 

strip. Taking -the letters VMQWEQUH in the foregoing i example, note the' • 
following series of placements of the successive strips. Then note how the 
successive plain-text letters of the word REGIMENT reappear to the left of the 



seccessive cipher letters MQWEQJJH. 




9 
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advance; if the interruptor is a plain-text letter, while the interruptions 
can be indicated before encipherment is begun, the irregularities occasioned 
by the interruptions in keying cause confusion and quite materially retard 
the enciphering process. In deciphering, the rate of speed would be just as 
slow in either method. It is 'obvious that one of the' principal disadvantages 
in all these methods is that if an error in transmission is made, if some 
letters are omitted, or if anything happens to the interruptor letter, the 
message becomes difficult or impossible to decryptograph by’ the drdinary code 
clerk. Finally, the degree of cryptographic security attainable by most of 
these methods is not sufficient for military purposes. 
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' SECTION VI. : ■ 

*' SOLUTION OF AUTO -KEY SYSTEMS, I. ’ ; 

Paragraph 

The two basic methods of auto-key encipherment . 23 

Solution of cipher- text auto-keyed cryptograms when known 

alphabets are • employed . 24 . 

Solution of cipher-text auto-keyed cryptograms by frequency analysis '25 
Special case of solution of cipher-text auto -keyed cryptograms ..... .26 

23. The two, basic methods of . auto-key encipherment . - a. In auto-key 
encipherment -there are two possible sources for successive key letters: the 

plain text or the cipher text of the message itself. In either case, the 
initial keyletter or keyletters are supplied by preagreement between the 
correspondents; after that the text letters that are to serve as the key 
are displaced 1, 2, 3, . . • intervals to the right, depending upon the 
length of the prearranged key. 

b. (1) An example of plain-text keying will first be shown, to re- 
fresh the student's recollection. Let the previously-agreed upon key con- 
sist of a single letter, say X, and let the cipher alphabets be direct 
standard alphabets. 

Key XNOTIFYQUAR T ER MASTER. . 

Plain NO T I F Y Q U A R T E R M ASTER... 

Cipher ...KBS B N D 0 K U R.K X V D M S L X V 

(2) Instead of having a single .letter serve as the initial key, 
a word or even a long phrase may be used. Thus (using TYPEWRITER as the 
initial key) : 

Key TYPEWRI T'ERl K OTIFY'QUAR. . 

Plain NOTIFYQUARTERM ASTER . 

Cipher ...GMIMBPYNEIGSKUFQJYR. . . 

c. (1) In cipher-text auto-keying the procedure is quite similar. 

If a single initial keyletter is used: 
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counterbalanced by the fact that whereas in the former case the cryptanalyst 
is dealing with the initial words of messages, in this case he is dealing 
with interior portions of the text and has no way of knowing where a word 
begins. The latter remarks naturally do not apply to the case where a whole 
set of'messages in this system, all in the same key, can be subjected to 
simultaneous study. In such a case. the cryptanalyst would also have the 
initial words to work upon. 

22. Concluding remarks. - a. The preceding two paragraphs both deal 
with the first and simplest of the three basic cases referred to under Par-. 1 
The second of those cases involves considerably more work in solution for' the 
reason that when the interruption takes place and the keying sequence recom- 
mences, the latter is not invariably the initial point of the sequence, as 
in the first case. ' 

_b. , In the second of - those cases the' interruptor causes a break in the 

keying sequence and a recommencement at any one of the. 10 keying elements 0 . 
Consequently, it is impossible now merely to superimpose sections of the. .text 
by shifting them so that their initial letters- fall in. the same column.. But 
a superimposition is nevertheless possible-, provided the interruptions do 
-not occur so frequently that sections of only a very few letters are encipher 
od by sequent keyletters. In order. to accomplish a proper superimposition ■ 
in this case, a statistical test would- be essential, and' for this a good . 
many letters are required. The nature of this test will be explained in 
Section X. • _ . ~ s ■ 

d. The same thing- is: true of the last of the. three cases mentioned 
under Par. 18. The. solution of a case of this sort is admittedly a . rather 
difficult matter which will be taken up in its proper place later. . 
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d_. (1) In the cases thus far studied, either the plain-text, groupings 

were variable in length and wore enciphered by a constant-length key, or the 

plain-text groupings wore constant in length and were enciphered by a variable 

length key. It is possible, however, to combine both principles and to apply 

a variable-length key to variable-length groupings of the plain text. 

(2) Suppose the communicants agree to encipher a message according 

to word lengths but, at irregular intervals, to add at the end of a. word an 

Interruptor letter which will serve to interrupt the key. Note the following, 

in which the key is BUSINESS MACHINES and the interruptor letter is X: 

Key B U S B 

Plain..-.. A M M U N I T I 0 N- FOR F I R S T X A R T I L L E R Y etc. 

Cipher. ., BTTRTODOWY E q V ZDFGJO BHDOSSJHI 

’• Cryptogram:' ■ - - ' " 

BTTRV 0 D 0 W V EQVZD FGJOB HDOSS-J HI.:., etc, . 

1 '• (3) The foregoing system is only a minor modification of the simple 

case of ordinary word length encipherment as -explained in Sect. II. If 
standard' cipher alphabets are used, ■ the spasmodic interruption- and the pre- 
sence' of the-' interruptor letter would cause no difficulty whatever, since the 
solution can be‘ ! achieved mechanically, -by completing -the plain-component. 

sequence".- If unknown mixed cipher alphabets are used, and the primary compo- 

^ ! 

nents are • unknown,' solution may be : reached • by following the procedure out- 
lined in Sections ■ II ■' and- III, with such 'modifications as are suitable to the 
case. i" : 

e_. It is hardly necessary to point out that the foregoing types of 
aperiodic- substitution are-- rather unsuitable - for practical military usage. 
Encipherment is slow, and' subject’ to error. In some cases encipherment' can 
be accomplished only by single-letter : operation. For if the - interruptor is 
a cipher letter the key is interrupted by a letter which cannot be known in 
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two distributions, frequency studies being aided by considerations based upon 
probable words. In this case, since the text comprises only the beginnings 
of messages, assumptions for probable words are more easily made than when 
words are sought in the interiors of messages. Such common introductory 
words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN, SEND, etc., are good ones to 
assume. Furthermore, high-frequency digraphs used as the initial digraphs of 
common words will of course manifest themselves in the first two columns. 

The grea'test aid in this process is, as usual, a familiarity with the "word 
habits" of the enemy. ' . • . 

(4) Let the student try to solve the messages. In so doing he 

will more or less quickly find the cause of the rapid falling off in mono- 

alphabeticity as the columns progress to the right from the initial point of 
the. messages. 

21. Interruptor is a cipher- text letter. - a_. In the preceding case a 

plain-text letter serves as the interruptor. But now suppose the communicant,? 

agree that the interruption in the key will take place immediately after a 

previously-agreed-upon letter, say Q, occurs in the cipher text. The key 

would then be interrupted as shown in the following example: 

Key BUS INES. SMAC HINES B'US'TNE'SSM ‘ 

Plain AM 11 UNIT I- 0 N.F ORFIR -STAR. TILL? 

Cipher. ..BOLYRPJDROJKXTPFYXSXBPUUQ 



Key 


B U 


S 


I 


N 


E S SIM' A 


C H 


r n 


B U 


S 


I 


N 


E S 


S 


M 


A C 


H 


B 


U 


Plain. . . . 


R Y 


w 


I 


T 

•U 


L 


B 


E L; 0 


A D E D . 


.A 


F 


T 


E 


R 


A M 


•M 


,U N 


I 


T 


I 


0 


Cipher. . . 


H R N M 


V 

X 


T 


T 


X H P 


CRFq 


B 


E 


J 


F 


I 


E L 


L 


B 


0 


N 


Q 


0 


Q, 


Key 


43 U 


s 


I 


N 


E 


S 


S M A 


C H 


B U 


S 


I 


N 


E 




















Plain. . . . 


•N F 


0 


R 


T 


H 


I 


R D A 


R ,T 


ILL 


E 


R Y 




















Cipher. . . 


V E 


c 


X 


B 


0 


D 


F P A 


Z Q 


0 N U 


F 


I 


C 





















Cryptogram: 

B 0 LYR PJDRO JKXTP FYXSX BPUUQ, HRNMY TTXHP 

• ■■ a- ( 

CRFQB EJFIE LLBON Q'O Q V E C X B_0 D FPAZQ ONUFI 



C XXXI 
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b.. In the foregoing example, there are no significant repetitions. 
Such as do occur comprise only digraphs, one of which is purely accidental. 
But the absence of significant, long repetitions is itself purely accidental; 
for had the interruptor letter' been a letter other than . Q, c , then the phrase 
AMMUNITION FOR, which occurs twice, might have been enciphered identically 
both times. If a short key is employed, repetitions may be plentiful. For 
example, note the follovilng, in which S p is', the interruptor letter: 



Key BANDS BANDS BANDS BANDS BAN 

Plain FROMFOURF IVETOFOURF IFTE 

Cipher. . . K T A K ZWX IIP A-C B N Z iff X I I D K W S 



BANDSBANDSB 
E N AM B AR RAGE 
JONKTBTIDHJ 



c_. This last example gives- a clue to one method cf attacking this typo 
of system. There will be repetitions within short sections, and the interval 



between them will sometimes permit of ascertaining the length of the key. In 
■such short sections, the letters which intervene between the repeated sequences 
may be eliminated as possible interruptor letters. Tims, the letters A, C, 

B, and N may be eliminated, in the foregoing example, as intorruptor letters. 

By extension of this principle to the letters intervening between other repe- 
titions, one may more or less quickly ascertain what letter serves as the 



interruptor. 

d_. Once the interruptor letter has', been, found, the next step is.. to 
break up the message into "uninterrupted” sequences and then attempt a solu- 
tion by superimposition. The principles explained in Par. 20 need only 'be 
modified in minor respects. In the first place, in this case the columns of 
text formed by the suporimposition of "uninterrupted sequences will be purely 
monoalphabetic , whereas in the case of the example in Par. 20, only the very 
first column is purely monoalphabetic, the monoalphabet icity falling off 
very rapidly with the 2d, 3d, . ... columns. Hence, in this case the analysis 
of the individual alphabets should be an easier task. But this would be 
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imposition can be employed, provided the messages can be superimposed correct 
ly, that is, so that the letters which' fall in one column really belong to 
one cipher alphabet. Just how this can be done will be demonstrated in sub- 
sequent paragraphs, and a clue has already been given in Par. 18c. At this 
point, however, a simple illustration of the method will be given, using the 
substitution system discussed in Par,' 19. 

b. Example . (1) A set of 35 messages has been intercepted on the 

same day. Presumably they are all in the same key, and the presence of repe- 
titions between messages corroborates this assumption. But the intervals 
between repetitions within the same message do not show any common factor 
and the messages appear to be aperiodic in nature.. The probable-word method 
has been applied, using standard alphabets, with.no success. The messages ■ 
are then superimposed (Fig. 5); the frequency distributions for the first 10 
columns are as shown in Fig. 6. 



1 


Z C T 


p 


Z W Z P 


E P 


Z 


q x 




19 


A F E 


0 J 


T D T 


I 


T 










2 


W T E 


Q M X Z S 


Y S 


P 


R 


C 




20 


K P 


V 


f q W P K 


T 


E 


V 








3 


TOR 


W 


C X T B 


H H 










21 


Z A 


B 


G R 


T X P U 


q 


X 








4 


E F K 


c 


SZRI 


H A 










22 


Y H 


E 


0 C 


U HM 


D 


T 










5 


YAH 


c 


IHZNUlf 










' 23 


C L 


C 


P Z 


IK 0 


T 


H 










6 


V Z I 


E 


TIRE 


G X 










24 


A F 


L 


w w 


z q m 


D 


T 










7 


H C Q 


I 


C K G U 


0 N 










25' 


: Z C 


W 


A P 


M B S 


A 


W 


L 








8 


Z C F. 


c 


L X R K q w 








4 


26 


H F 


L 


M H 


R Z N 


A 


P 


E 


C 


E 


I 


9 


H W W 


p 


TEWC 


I M 


J 


S 






27 


C L 


Z 


G E 


M K Z 


T 


0 










10 


E P D 


0 


Z C L I 


K S 


J 








28 


T P 


Y 


F K 


0 T I 


Z 


u 


H 








11 


ITS 


s 


Q Z P Z 


I E 


T 








29 


Z C 


C- 


P S 


N E 0 


P 


H 


D 


Y 


L 




12 


Z C G 


G 


YFCS 


B G, 










30 


C I 


Y 


G I 


F T S 


Y 


T 


L 


E 






13 


C W Z 


A 


0 0 E'M 


H W 


T 


P 






31 


Y T 


S 


V W 


V D G H 


P 


G 


U 


Z 




14. 


C I Y 


,G 


I F B D 


T V ,X 








32 


NO 


C 


A I 


F B J 


B 


L 


G 


H Y 




15 


E A q 


D 


R D N S 


R C 


A 


P 


D T 




33 


Z X X F L F E G 


J 


L 










16 


YFlff 


C 


q q b, z 


C..W 


C 








34 


Z C 


T M M 


B Z J 


0 


0 










17 


W T E 


Z Q S K u 


H C 






V 




35 


H C 


q 


I W 


SYS 


B 


P 


H 


C 


Z 


V 


18 


Z C V 


x q z k z 


YD 


W 


L K , 



























Figure 5 
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■ 1 if C dI F G H I J E 1 M NO P q R S T U ??X Y I 

= f 5 ' - ; ; 9 ■'= = _ ' 

. : 2 ABC D E FGH I J K L. M NOP Q, R S T U V W IYZ 
3 A B C D E F G H I J K L M N 0 P 1" R S T U V ¥ X Y Z* 

. .. 4 ABCDEfI fiJjKLHN JPQH S TUYIXYZ 

5 abFdefCtH?.tk'B M ‘n cppsfu V : W XYZ 

6 A.B C D EF GH IjIlIIo P qR S T U V Wx Y Z* 

7 AECDEFGHIJ ?L‘M no p qTs Fu V'¥ IYZ 
8.. ABC D E • F ¥. H .1 J K LMNOP Q R S T U 7 V! XYZ 

9 ' if^DEFoli JILMNOP qi : ST U V W XYZ 

10 Ab!dEFGHI JKLillOPQE S TD V W XYZ 

, ' - " ' ■ • - *' 

■ . Figure 6, ' . '* 



(2) The 1st and 2d distributions are certhinly monoalphabetic. 

There- are very marked crests: and troughs, and the number . of blanks (15 and i4 ; 
respectively) is more than satisfactory in both casos, (‘Let the student at 
this point refer to Par. 14 and Chart 5 of Military Cryptanalysis, Part I.) 

But the 3d, 4th, and remaining distributions appear no longer to be mono- •’ 
alphabetic. Note particularly the distribution for the 6th column. From this 
fact the conclusion is drawn that some disturbance in periodicity has been - 
introduced in the cryptograms. In other words, although they all start out 
with the same alphabet, some sort of interruption takes place so as to suppress 

r' 

periodicity. 

(3) However, a start on solution may be made by attacking the first 
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(2) Since this "key” is certainly not intelligible text, the 

assumed word is moved -one letter to the right and the test repeated, and so 

on until the following place in the test is reached: 

Cipher... SXDJ-PUSYI 
Plain' ARTILLERY 

Key...... SIBUSINEB - 

\ 

(3) The sequence EUSINE suggests. BUSINESS; moreover, it is noted 
that the key is interrupted both times by the letter. R . Nov; the key. may be 

sr 

applied to the beginning of the message, to see if the v/hole key or only a 
portion of it has been, recove red. Thus: ' •• • • 

t 

Key...... BUS I N E SS B -U S 

Cipher. ... BOLYRPJDROJ 

Plain.... A M M UNI T IU MT 

(4) It is obvious that BUSINESS is only a part of the key. But 

the' deciphered sequence certainly seems to be the word AMMUNITION. When this 
is tried, the key is extended to BUSINESS MA... . Enough has been shown to 
clarify the procedure. . ■ . 

f. The foregoing solution is predicated upon the hypothes is that the 
cipher alphabets are known. But what if this is not the case? What of the 
steps necessary to arrive at the first solution, before even the presence 
of an interruptor is suspected? The answer to this question leads to the 

t. . 

presentation of a method of attack which is one of the most important and 
powerful means the cryptanalyst has at his command for many knotty problems. 
It is called’ solution by superimposit io n , ..and warrants detailed' treatment. 

20.' Solution by superimposition'. - a. ' Basic principles . - (1) In solv- 
ving an ordinary repeating-key cipher the first stop, that 'of ascertaining 

i 

the length of the period, is of no significance in itself. -It merely paves 
the way for and makes possible the second step, which consists- in allocating 
the letter's of the cryptogram into individual monoalphabetic distributions. 
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The third step then consists in solving these distributions. Usually, the 
text of the message is transcribed into its periods and is written out in 
successive lines corresponding in length with that of the period. The diagram 
then consists of a series of columns of letters and the letters in each column 
belong to the some monoalphabet. Another wa y of looking at- the matter is to 
conceive of the text as having thus been tivmscribcd into superimposed periods ; 
the letters . in each column have undergone the same kind of treatment, by the 
same elements (plain and cipher components of the cipher alphabet). 

(2) Suppose, however, that the . repetitive. key is very long and 
that the message is short, so that there are only a very few cycles in the 
text. Then the solution of the message becomes difficult, if not impossible, 
because there is no.t a. sufficient number of superimposable periods to yield 
monoalphabet ic distributions which, can be solved by frequency principles. ■ 

But suppose also that there are many short cryptograms all enciphered by the 
same key. Then, it is clear that if these- messages are superimposed: 

(a) The letters in the respective columns will all belong to 

individual alphabets; and 

/ . 

(b) If there is a sufficient number of such superimposable 
messages (say -25 - 30, for English), then the frequency distribu- 
tions applicable to the successive c olumns of text can be solved • — 
without- 1 knowing the length of the key . In other words, any difficul- 
ties that may have arisen on .account of failure or inability to 

■ ascertain the length of the period have been circumvented. The. . 

. .second step in normal solution is thus- "by-passed". 

(3) Furthermore, and this is a very important point, in case an 
extremely long key is employed and. a. series of messages beginning at different 
initial points are enciphered by such a key, this method of solution by super- 
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/ 

Cryptogram: ' 

BOLYR PJ DR .0 J K X K J FYXSX D . J U P S - Y I YD P , Y F 

X U R ■■ A F A E N . M J J.V B OLYRP JDROJ KX D G D X G U F.D 

J G P S Y I X XXX. 

b. Instead . of employing an ordinary plain-text letter. as the interrup- 

tor, one might reserve the letter J- for this purpose (and use the letter I 

whenever this letter appears as part of a plain-text word). This is a quite 

simple variation of the basic . method. The letter. J acts merely as though it 

were a plain-text -letter, except that in this case it also servos as the 

interruptor. The interruptor is then inserted at random , at the whim of the 

enciphering clerk,- Thus: . , . 

Key HJSINESSMAC . HJSINESSM BUSIKESSMACHINESBUSIII 

Plain.., TROOPSWILU BEHALTEDJ ATROADIUNCTIOEF IVESIX 

c_. It is obvious that repetitions would be plentiful in cryptograms- 
of this construction, regardless of whether a letter of high, medium, or low 

frequency is selected as the signal for key interruption. If a letter of 

high frequency is chosen, repetitions will occur quite often, not only because 
that letter will certainly be a part of many common words, but also because 
it will be followed by words that are frequently repeated; and since the key 
starts again with each such interruption, these frequently- repeated words 
will be enciphered by tho same sequence of alphabets. This is the case in 
the first of the two foregoing examples. It is clear, for instance, that 
evory time the word ARTILLERY appears in the cryptogram the cipher equivalents 
of TILLERY must be the some. If the interruptor letter were Ap instead of Rp, 
tho repetition would include the cipher equivalents of RTILLERY; if it were ' 
Tp, ILLEKY, and so on.. On the other hand, if a letter of low frequency were 
selected as the interruptor letter, then the encipherment would tend. to appro- 
ximate that of normal ropeating-key substitution, and repetitions would be 



plentiful on that basis alone 
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cL Of course, the lengths of the ' intervals between, the repetitions, in 
any of the foregoing cases, would be irregular, - so that periodicity would not 
be manifested. The student may inquire, therefore, how one would proceed to 

I 

solve such messages, for it is obvious that an attempt to allocate the letters 
of a single message into separate monoalphabetic distributions cannot be 
successful unless the exact locations of the interruptions are known — and 
they do' not "be come known to the : cryptanalyst until he- has solved the message, 
or at least a part of it. Thus it would appear as though-the would-be solver 
is here confronted with a more or less insoluble dilemma-', This sort of reason- 
ing, however, makes more of an appjeal to the uninitiated observer than to 'the 
experienced cryptanalyst, who specializes in methods of solving cryptographic 
dilemmas. ! 

e_. (l) The problem here will be attacked, upon the usual two hypotheses., 

and the easier one will be discussed first. Suppose the system has' been in 
use for some time., that an original solution has been reached by means to be 
discussed under the second hypothesis, and that the cipher alphabets are known. 
There remains unknown only the specific key to messages. Examining whatever' 

repetitions are found, an attack is made on the basis of searching for a 

. ’ ' - 'I 

probable word. Thus., taking the illustrative message in subpar. a_, suppose 
the presence of the word. ARTILLERY js suspected. Attempts are made to locate 
this word, basing the search upon the construction of an intelligible key. 
Beginning with the very first letter of the message, the word ARTILLERY is 
juxtaposed against the cipher text, and the key letters ascertained, using 

I 

the known alphabets, which we will assume in this case are based upon the 

HYDRAULIC .. .XZ sequence sliding against the normal. Thus: 

‘ ‘ | " ■; ... ’ ■ 

Cipher. . iB OLYRP JDR 

Plain A.R T ILL1RY 

"Key". . . IBHJQPIBFU 
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the matter may become quite complex. 

jc. If one knows when the interruptions take place in each cycle, then 
successive sections of the basic keying cycle in the three cases may be super' 
imposed. Thus: 

Method (1) 

KEYING ELEMENT NUMBER 







1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


Letter 


No. 


1 


2 


3 


4 1 














Letter 


No. 


5 


.6 


7 


8 


9 


10 


1 








Letter 


No. 


11 


12 


13 


i 














Letter 


No. 


14 


15 


16 


17 


18 


19 


20 


1 






Letter 


No .. - 


21 


22 


23 


24 


25 


26 


27 


28 


29 


30 | 


Letter 


No, 


'31 


32 


33 


1 














Letter 


No. 


34 


35 


eic 


• 















Metho d (2) 

KEYING ELEMENT ' NUMBER 









1 


2 


3 • 


4 


5 


6 


7 


8 


9 


10 


Letter 


No. 
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2 


3 


1- 


- 


- 


4 


5 


6 


7 


Letter 


No. 
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1- 
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11 
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- 
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14 
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No. 
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- 
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No. 
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26 


1- 


- 


27 


28 
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1- 
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Letter 


No. 
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1- 


- 


- 


33 


34 


35 


etc 


• 





Method ( 5) 

keying element number 
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Letter No 
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or how • ' 

Obviously if one does not know when/the interruptions take place, then the 
successive sections of keying elements can not be superimposed as indicated 
above . - 

» 

d_. The interruption of the."eyclic keying sequence usually takes place 
according to some prearranged plan, and the three basic methods of interrup- 
tion will be taken up in turn, using a short mnemonic key as an example. 

• e_. Suppose the correspondents agroe that -the interruption in the key- 



ing sequence will tako place after, the occurrence of a,, specified letter called 
an interrupt or '*', which may be a letter of the plain text, or one of the cipher 
text, as agreed upon in advance. Then, since in cither case there is nothing 



fixed about the time the interruption will occur -- it will take place , at 



no fixed intervals — not only does the interruption become quite irregular, 
following no pattern, but also the method never reverts to one having perio- 

.. ... i_ 

dicity. Methods of this type will now be discussed in detail. 

19. Interruptor is a plain-text letter. - a_. Suppose the communicants 



agree that the interruption in the key will take place immediately after a 
previously agreed-upon letter, say R, occurs in the plain text. The key 
would then be interrupted as shown in the following example (using the mnemonic 



key BUSINESS MACHINES; and the HYDRAULIC .. . XZ sequence): 



Key. 

Plain. . . . 
Cipher. . . 
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U 


S 


I 


N E 


S 


S 


M A 


C H 


I- 


B U 


s 


-B.U 


S I 


B 


U 
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I 


N 


E 


A 


M 


M 


U 


N I 


T 


I 
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F 6 


R 


F I. 


R 


‘S' T 


A. R 


T 


I 


L 


L 


E 


R 


B 


0 


L 


Y 


R- P 


J 


D 


•R 0 


J- K 


X 


K.’T 


F 


Y- X 


s'x- 


D 


J 


U 


P 


S 


Y 



Key 

Plain. . . . 
Cipher. . . 



BUSIN E SSM 
YWILLB E L 0 
IYDPYF XU R 



ACKINESBU 
A D E D A F T E R 
A F A..1N.M J J V 



'BUS HIE 
AM M'U N I 
B 0 L Y R P 



S S M A C H I 
.T I 0 N F 0 R 
J D R 0 J K X 



Key BUS I 


BUS 


.BUS IKE 


BUSIN 


Plain T H I R 


DAE 


TILLER 


Y 


Cipher. . . D G D X 


G U F 


D J U P S Y. 


I » • ; . • • 



Also called at times an "influence" letter because it influences or modifies 
normal procedure. 



:• 

i 
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SECTION V 

SOLUTION OF SYSTEMS USING VARIABLE-LENGTH KEYING 
UNITS TO ENCIPHER CONSTANT-LENGTH PLAIN-TEXT GROUPINGS 



■'Paragraph. 

Variable-length groupings of the keying sequence 17 

Methods of interrupting a cyclic keying sequence 18“ . 

Interruptor is a plain-text letter 19 

Solution by superimposition . 20 

Interruptor is a cipher- text letter 21 

Concluding remarks 22 

17. Variable-length groupings of the keying sequence. - The preceding 



cases deal with simple methods of eliminating or avoiding periodicity by 
enciphering. variable-length groupings of the plain text, using constant- 
length keying units. In Par. 2a, however, it was pointed out that periodicity 
can also be suppressed by applying variable-length key:' groupings to constant- 
length plain- text groups. One such method consists in' irregularly interrupt- 
ing the keying sequence, if the latter is of a limited ' or fixed' length, and 
recommencing it (from its initial point) after such interruption, so that 
the keying sequence becomes equivalent to a series of keys of different 
lengths. Thus, the keyphrase BUSINESS MACHINES may be expanded to a series 
of irregular-length keying sequences, such as BUSI/BUSINE/BU/BUSINESSM/ 
BUSINESSMAC, etc. Various schemes or prearrangement.s for indicating or 
determining the interruptions may be adopted. Three methods' will be mention-, 
ed in the next paragraph. ■ • 

18. Methods of interrupting a cyclic, keying sequence. - a_. There are 
many methods of interrupting a keying sequence which is basically cyclic, 
and which therefore would give rise to periodicity if not interfered with 
in some way. These methods may, however, be classified into three categories 
as regards what happens after the interruption occurs: 

(1) The keying sequence merely stops and begins again at the initial 
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point of the cycle. 

(2) One or more, of the elements in the keying sequence may be 



omitted from time to time irregularly. 

(3) The keying sequence irregularly alternates in its direction 

of progression, 'with or without omission of some of its elements. 

' b_. * These methods may, for clarity, be represented graphically as 

follows. Suppose the key consists, of a cyclic sequence of 10 elements repre- 

sented symbolically by the series of numbers 1, 2, 3, . .., 10. Using an 

asterisk to indicate an interruption, the following may then represent the' 1 

relation between the letter number of the message and the element number of 

the keying sequences in the three ^types' mentioned above. 

Letter No........ 1234 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

Key element No... l-2-3-4-*-l-2-3-4-5- 6-*-l- 2- 3-*- 1- 2- 3- 4- 5- 6- 7-*- 

( 1 ) ! ’• . 

Letter No 21 22 23 24 25 26 27 28.29 30 31 32 33 34 35 

Key element No... 1- 2- 3- 4- 5-j 6- 7- 8- 9-10- 1-, 2- 3-*- 1- 2- etc. 



Letter No .......... 1 2 3 4 5 6 7. 8 9 10 11 12 13 14 15 16 17 18 19 20 

Key element No... ' l-2-3-*-7-8-9-10-l-2-*- 4- 5- 6-*- 3- 4-5- 6- 7- 8- 9-10- 

,( 2 ) 

Letter No 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

Key element No... l-*-8- 9-10- 1- 2-*- 5- 6- 7-*- 9-10- l-* r 5- 6- 7- etc. 

■’ ' ' ! 

Letter No......'.'. 1 2 3 4 5 6,7 3 9 10 11 12 13 14 15 16 17 18 19 20 

Key element No... l-2-3-4-5-*-4i3-*_4_5_ 6- 7- 8- 9-10- l-*-10- 9- 8- 7-*- 8 

(3) 

Letter No 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

Key element No... 9-10- 1- 2- 3 r *- 2- 1-10- 9- 8-*- 9-10- 1- 2- 3 etc. 





As regards the third method, whic'h involves only an alternation in the direc- 
tion of progression of the keying sequence, if there were no interruptions . 
in, the. key it would mean merely that a 10-element keying sequence, for example 
could be treated as though it were an 18-element, sequence and the matter could 
then bo handled as though it were a special form of tbe second method. But 
if the principles of the second and third method are combined in one system, 
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occurrences of tho word (the sum of the values of the letters of the key- 

phrase = 140); and then the chances that the keyletter P would begin the 

encipherment of DPV are but one in three. Only one of these three possible 

encipherments will yield exactly the same sequence of cipher equivalents the 

second time as was obtained the first time* For example, if the text were 

such as to place two occurrences of the word DIVISION in the positions shown 

below, their encipherments would be as follows: 

3 11 3 2 1 1 2 3 1 3 11 3 2 112 3 1 

P REPARED PREP A R ED U N 

FIR S T DIV IS I 0 N DI VI S I ON ... . 

. .. . . THJ GV F X M .... .TH ZG T P NM . . . ■ . 

Although the word DIVISION, on its second appearance, begins but one letter 
beyond the place where it begins on its first appearance, the cipher equiva- 
lents now agree only in the first two letters, the fourth, and the. last 
letters. Thus: DIVISION ' 

(1) T_H J G V FXM 

( 2 ) T_H ZGTPNM 

_e. Attention is directed to the characteristics of the foregoing two 
encipherments of the same word. When they are superimposed, the first two 
cipher equivalents are the same in the two encipherments; then there is a 
single interval where the cipher equivalents are different; the next cipher 
equivalent is the same; then follow throe intervals with dissimilar cipher 
equivalents; finally, the last cipher equivalent is the same in both cases. 
The repetitions here extend only to one or two letters; longer repetitions 
can occur only exceptionally. The two encipherments yield only occasional 
coincidences , that is, places where tho cipher letters are identical; more- 
over, the distribution of the coincidences is quite irregular and of an 



intermittent character 
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f. This phenomenon of intermittent coincidences, involving coinci- 



dences of single letters, paips of letters, or short sequences (rarely ever 
exceeding pentagraphs) is one of the characteristics of this general class 



of polyalphabet ic substitution, wherein the cryptograms commonly manifest 
what appears to be a disturbed or! distorted periodicity. 

g. From a technical standpoint, the cryptographic principle upon 
which the foregoing system is based has much merit, but for practical usage 
■it is entirely too slow and too subject to error. However, if the encipher- 
ment were mechanized by machinery j and if the enciphering key were quite 
lengthy, ‘ such a system and mechanism becomes of practical importance. Cipher 
machines for accomplishing this type of substitution will be treated in a 
subsequent text.- •' 
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irregular groupings in encipherment. The de-termination of the length of the 
cycle might, however, present difficulties in some cases, since the basic 
or fundamental period would not be clearly evident because of the presence 
of repetitions which are not periodic in their origin. For example, suppose 
the word PREPARE were used as a key, each keyletter being employed to en- 
cipher a number of letters corresponding to its numberical value in the 
normal sequence. It is clear that the length of the basic' period, in 'terms 
of letters, would hero be the sum of the numerical values of P (a» 16)-+- R (- 1 
4 * E (o 5) .'and so 1 on,, totalling 79 letters. But because the key itself contain 
repeated letters and because encipherment by each keyletter is monoalphabet ic ... 
there' would be' plenty of cases in which the first letter P would encipher the 
same; or part of the same word as the second letter P, producing repetitions in 
the cryptogram. The same would be true as- regards encipherments by the two 
R's 'and the two E's in this keyword. Consequently, the basic period of 79 
would be distorted or masked by aperiodic repetitions, the intervals between, 
which would not be a function of, nor bear any relation to, the length of the 
key. The student will encounter more cases of- this kind, in which a fundamen- 
tal periodicity is masked or obscured by the presence of cipher-text repeti- 
tions not attributable to the fundamental cycle. The experienced -cryptanalyst 
is on the lookout for phenomena of this type, when he finds in a polyalpha- 
betic cipher plenty of repetitions but with no factorable constancy which 
leads to the disclosure of a' short period. He may conclude, then, either 
that the cryptogram involves several primary periods which interact to produce 
a long resultant period, or that it involves a fairly long fundamental cycle 
within which repetitions of a nonperiodic origin are present and obscure the 
phenomena manifested by repetitions of a periodic origin. ; 

d. (1) A logical extension of the principle of polyalphabetic encipher- 
ment of variable -length plain-text groupings is the case' in which these plain- 




REF ID : A4 14 6453 

- 28 - 



text groupings rarely exceed 4 letters, so that a given cipher alphabet is 
in play for only a very short time, thus breaking up what might otherwise' 
appear as fairly long repetitions in the cipher text.' For' example, suppose 
the letters of the alphabet, arranged in their normal-frequency order, were 
, set off into four groups, as follows: 

ETEIN "6" A S D L C HFEPMYS W V B X K Q, J Z 
Group 1. Group 2 Group 3 Group 4 

. : (2) • Suppose that. a letter, in group 1 means that- one letter will 

bo ; enciphered; a letter in group t 2, that two letters will be enciphered; and 
so on. Suppose-, next, that a rather lengthy phrase were used as a key, for 
example, PREPARED UNDER THE. DIRECTION OF THE CHIEF. SIGNAL OFFICER FOR. USE 
WITH .ARMY. EXTENSION COURSES. Suppose, finally, that each letter of the key 
’Were used not -only to .select the particular cipher alphabet to be used, but 



also, to control the number of letters to be enciphered by the selected 



alphabet, according to the .scheme .outlined above. Such an enciphering scheme 



using the HYDRAULIC. ...XZ primary cipher component sliding against the normal 



plain component, would yield the Hollowing groupings: 
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■ (3) .- Here'-, it will be seen that any tendency for the formation of - 

lengthy -repetitions would be counteracted by the short groupings and quick 

j 

shifting of alphabets. The- first time the word DIVISION .occurs it is enci- 
phered as THJGVFXM; - the second time it occurs it is enciphered as . KPRNPCKS. 
Before DIVISION can be twice . enciphered- by exactly the same sequence of key 
letters, an interval of at least 140 letters must intervene between the two 
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messages or when there are many short messages, a study of isomorphism will 
disclose a sufficient number of partial isomorphs to give data usually 
sufficient for purposes of alphabet reconstruction* 

e_. It should be noted that there is nothing about the phenomenon of 
isomorphism which restricts its use to cases in which the cipher alphabets 
are secondary alphabets resulting from the sliding of a mixed component again. 

. J 

the normal. It can be useful in all cases of interrelated secondary alphabets 
no matter what the basis of their derivation may be, 

f_. In subsequent studies the important roio which the phenomenon of 
isomorphism plays in cryptanalytics will become more apparent. When the 
traffic is stereotypic in character, even to a slight degree, so that iso- 
morphism may extend over several words ,or phrases, the phenomenon becomes 
of highest importance to the cryptanalyst and it becomes an extremely valu- 
able tool in his hands, 

15, Word separators. - a. One of the practical difficulties in employ- 
ing systems in which the keying process shifts according to word lengths is 
that in handling such a message the decryptographing clerk is often not 
certain exactly when the termination of a word has been reached, and thus 
time is lost by him. For instance, while decryptographing a word such as 
INFORM the clerk would not know whether he now has the complete word and 
should shift to the next key letter or not: the word might be INFORMS, INFORM- 

ED, INFORMING, INFORMAL, INFORMEEON, etc. The past tense of verbs, the plural 
of nouns, and terminations of various sorts capable of being added to word 
roots would give rise to difficulties, and the latter would be especially 
troublesome if the messages contained a few telegraphic errors. Consequently, 
a scheme which is often adopted to circumvent this source of trouble is to 
indicate the end of a word by an infrequent letter such as Q, or X, and en- 
ciphering the letter; in such usage these letters are called word separators . 
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Jb. When word separators are employed and this fact is once discovered, 
their presence is of as much aid to the cryptanalyst in his solution as it 
is to the clerks who are to decryptograph the messages. Sometimes the pre- 
sence of these word separators, even when enciphered, aids or makes possible 
the blocking out of isomorphs'. 

16. Variations and concluding remarks on foregoing systems. - a_. The 
systems thus far described are all based upon word-length. encipherment using 
different cipher alphabets. Words are, markedly irregular in regard to this 
feature of their construction, and thus aperiodic ity is imparted to such 
cryptograms. But variations in the method, aimed at making the latter some- 
what more secure, are possible. Some Of those variations will now be discusse 

b. Instead of enciphering according to natural word lengths, the irre- 
gular groupings of the text may be regulated by other .agreements. For 
example, suppose that the numerical value (in the normal sequence) of each 
keyletter be used to control the number of letters enciphered by the succes- 
sive cipher alphabets. Depending it hen upon the composition of the keyword 
or keyphraso, there would be a varying number of letters enciphered in each 
alphabet. If the keyword were PREPARE, for instance, then the. first cipher 
alphabet would be used for 16 («P) letters, the second cipher alphabet, for 
18 (m R) letters, and so on. Monoalphabetic encipherment would therefore 
allow plenty of opportunity for tell-tale word patterns to manifest themselves 
in the cipher text. Once an entering wedge is found in this manner, solution 
would be achieved rather rapidly. ' Of course, all types of cipher alphabets 
may be employed in this and the somewhat similar schemes described. 

..... . i . • , ... 

c_. If the key is short, and the message is long, periodicity will be 
manifested in the cryptogram, so that it would be possible to ascertain the 
length of the basic cycle (in this case the length of the key)- despite the 
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found that many messages begin with the expression REFERRING TO YOUR NUMBER... 
Having several messages for study, the selection of one which begins with 
such a common idiomorphism as that given by the word REFERRING. is a relative- 
ly simple matter; and having found the word REFERRING, if with a fair degree 
of certainty one can add the words TO YOUR NUMBER, the solution is probably 
well under way. 

c_. (1) Take the case discussed in Par. 13, but assume that word 

lengths are no longer indicated because the message is transmitted in the 
usual 5-letter groups. The process of ascertaining . the exact length of se- 
quences which are isomorphic, or, a's the process is .briefly; termed, "blocking 
out isomorphs" becomes a more difficult -matter and must often rest upon rather 
tenuous threads of reasoning. For example, take the illustrative message 
just dealt with and let it be assumed that it tvas arranged in 5-letter groups. 
VCLLK IDVSJ DCIOR KDCFS TVIXH MPPFX 

UEVZZ FKNAK FORAD KOMPI SECSP PHQKC 

LZKSQ L.PROJ ZWBCX HOQCF FAOXR OYXAN 

0 E'M DM ZMTST ZFV.UE AORSL AUPAD DERXP 

NBXAR IGHFX JXI 

(2) The detection of isomorphisms now becomes a more difficult 
matter. There is no special trouble in picking out the following three 
isomorphic sequences : 

(1) V C L L IC I D V S J D C I 

(2) C S P P H Q, K C L Z K S Q, 

(3) PADDEHXPNBX A R 

since the first one happens to be at the beginning of. the message and its 
left-hand boundary, or "head", is marked by (or rather, coincides with) the 
beginning of the message. By a,, fortunate ^circumstance', the right-hand bound- 
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ary, or "tail”, can be fixed just as accurately. That the repetition extends 
as far as indicated above is certain for we have a check on the last column 
I, Q,, R. If . an additional column'were added, the letters would be 0, L, I. 
Since the second letter has previously appeared while the first and third have 
not, a contradiction results and the new column may not , be included. 

. \ . . If, however, no one of the three letters 0, L, I had previously appeared 

so that there could be no means of getting a chock on their correctness, it 
would not be possible to block out or ascertain the extent of the isomorphism 
in such a case. All that .could be said would be that it seems .to include .the 
first thirteen letters, but it might conti duo furt her . 

cl. (l) , However, the difficulty or even the impossibility of blocking 
out the isomorphs to their full extent is not usually a serious matter. After 
all, the cryptanalyst uses the phenomenon not to identify words but to obtain 
cryptanalytic data for reconstructing cipher alphabets,. For example, how 
many data are lost when the illustrative message of subpar'. 13a. is rewritten 
in 5-letter groups as in subpar. 14c (1)? Suppose the latter form of message 
be studied for isomorphs: 

7 C L LI IDVSJ DCI QR ;K D C F S T.7I X H M PPFI UEV.Z.Z 

FKNAK FORAD KtiP I S E C S P ' P H"Q K C L Z ,K S ft LPROJ 

ZWBCX H 0 Q, C F FAOXR iOYXAN OEM DM. ZMTST ZFVUE 

i 

AORSL AU PAD DERXP jNBX AR IG.HFX JXI 

(2) If the underscored sequences are compared with, those in the 
message in subpar. 13a, it will be found that only a relatively small amount 
of information has been lost. Certainly not enough to cause any difficulty 
have been lost in this case, for all the data necessary for the reconstruc- 
tion of the mixed cipher component came from the first set of isomorphs, and 
the latter are identical in length in both cases. Only the head and tail 
letters of the second pair- of isomorphic sequences are not included in the 

, I 

underscored sequences in the 5-letter version of the message. The third pair of 
isomorphic sequences shown in Par. 13b_ does not appear in the 5-letter version 
since there is only one repeated letter in this- case. In long 
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(4) From idiomorphs (2)(a) and (2)(b), the interval between H and 
I is 7; it is the same for 0 and X, Q, and H, : C and M, etc. From idiomorphs 

(3)(a) and (3)(b) the interval between R and N is 13; it is the same for 

0 and A, Y and K, etc . 

d. The message may now be solved quite readily, by the usual process 
of converting the cipher-text letters into their plain-component equivalents 
and then completing the plain component sequences. The solution is as follows 
... . (Key: STRIKE WHILE THE IRON IS ) 

S T R I K 

COMMUNICATION W I T. H F I R S T , A R T I L L E R Y WILL 
V C L L K ID VS J D C I ORKD CFSTV IXHMPPFXU EVZZ 

E W H I L 't E 

.BE T H.R 0 U G H C.ORPS A.N D COM M TJ N I C. A T 1.0 N W I T H 

F K N A K F 0 R A D K 0 M P I S E C S P P H ^ K C L Z K S Q L P R 0 



H E I R 

ILLERY THROUGH DIVISION SWITCH 
C F F A 0 X ROYXA.NO EMDMZMTS T Z F V U E 

0 N I S' 

B OAR D NO COMMUNICATION AFTER TEN 
AORSL AU PADDERXPNBXAR IGHFX J X I 

e_. (1) In the foregoing "illustration the steps are particularly simple 

because of the following circumstances: 

(a) The actual word lengths arc shown. 

(b) The words are .enciphered monoalphabetically by different 
alphabets belonging to a set of secondary alphabets. 

(c) Repetitions of plain-text words, enciphered by different 

alphabets, produce isomorphs and the lengths of the 
isomorphs are definitely known as a result of circum- . 
stance (a) , - 



T 
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(2) Of these facts,, the last is. of most interest in the present 
connection. But what if the, actual word lengths are not shown; that is, 
what if the text to, be. solved is | intercepted in the usual 5-letter-group 
form? ’ | 

' . SECTION XV 

SOLUTION" OF ' SYSTEMS USING ; C QNSTANT -.LENGTH KEYING .UNITS 
TO ENC IP ISE. ViUiI:lBLE -LENGTH PLAIN-TEXT GROUPINGS, .'III V. 



f . Paragraph 

General remarks 14 

Word separators > 15 

Variations 'and' concluding remarks on foregoing ' systems 16 



14. General remarks., - a_. . The cases described thus far are particu- 
larly easy to solve' because the cryptanalyst has before him. the' messages in 
their true or original word lengths. But in military cryptography this is 
seldom qr never the' case. The problem is therefore ' made somewhat more 
difficult by reason of the fact that there is nothing to indicate definitely 
the limits of encipherment by successive keylctters. However, tho solution 
merely necessitates more experiment at ion in this case than in the preceding. 
The cryptanalyst must take careful note of repetitions which may serve to 
"block out" or delimit words, arid hope that when this is done he will be 
able to find and identify certain sequences having familiar idiomorphic 

t • f , • 

features or patterns, such as those noted above. If there. is plenty of text 

... . ; v 

repetitions will be sufficient in number to permit of employing this entering 

wedge. . ; 

b^. Of course, if any sort of stereotypic phraseology is employed, 
especially at the beginnings or endings of the messages, the matter of -assum- 
ing values for sequences of cipher letters is easy, and affords a quick solu- 
tion. For example, suppose that as a result of previous work it has been 
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the data is to handle the text digraphically, taking the 1st and 2d letters, 
the 2d and 3d, the 3d and 4th and so on, and, distributing the final letters 
of each such digraph, in a quadricular table.: The distribution merely takes 
the 'form of tally marks , the fifth being a diagonal stroke so as to totalize 
the' counts automatically,.. This yields Table 1. 
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_ci Table 1 now presents 26 uniliteral, mono alphabetic frequency d is.tr i 
but ions. If there were more data in each distribution they could be solved 
in the usual manner. ; Naturally, the distributions' which -have .the greatest 
numbers of occurrences would be the ones' most easily, analyzable and there-;; 



fore the first to be attacked. In this process advantage would be taken of 
such long repetitions as arc present in the cryptograms, since it is clear 
that given sufficient text there will be such repetitions. For example, note 

„ ‘ . . ■ ■ ' • 1 ; j f ' ■ ' • , , ■ 

the 1 ’ 9-letter .sequence underscored in message 1 which is repeated in message ! 3 
• d. ■ - It is to be noted ’in connection with- the. subject, .of . repetitions in 
this system -that a .repetition , in the ■; cipher -text ^represents an equal-length 
.repetition in the plain- text. In the case > of ;plain4text iauto-keyihg this is . 

■ ’ i r i ' .} , J ( ; * ’ ; 

hot the case, the cipher4text repetition being one letter shorter in length ; ' 

than the -plain- text repetition, Furthermore,: it -is ; to be nqted: that' in cipho 

text. ...auto-keying, if basic enciphering equations: 0 : , =6 . < 1 • A : • r A j . •' 

a ; plain ; / T . f l /» > k U ~ P/l <4*. , 

are;' in effect with/(hormal^componeht -, then every time the. letter. A^... occurs ; 

in the | plain text there,' will he a doublet in the' cipher' text," ho matter what 

the _ key letter for enciphering Ap is and ho matter what: -the cipher, component.; i, 

• • * • * . • ■ f ' • ? * .* , * • ’ i ’ ; 

For- example, using a d-ir act .'standard alphabet as the plain - component' and- the:. 



HYDRAULIC-. . .XZ sequence as the. cipher' component (introductory key letter (X)h 



■' 'Key. . . X E E li? A- A W N U ■ 
' Plain. . MAN H "A 'T TAN; 
; cipher..;. . E_L W A_A M N_N R 



• ; : i 



This means that doubled .letters in , such a system may be -studied with ;a view 
to identifying certain frequently-used words: containing the- letter A, such 

• ' , ► : * > \ ■ t i ' . 

as BATTALION, ARTILLERY, • etc . 1 ..... ... ; . . /’, \ j if ■ 

a. : If' the underscored i repe!tit'ibh""xh : the case of the illustrative .- u 
messages is studied with this in mind, it may be assumed to represent the : , 





REF ID:A4146453 



word ARTILLERY. Thus: 

Key. ...... V V J L K Z'E K U R . .' 

Plain... .. .ARTILLERY... 

Cipher. . . TVJLK2EKUR. . . 

~~ ZJ 

Now note that if this tentative identification is correct there are two tell- 
tale characteristics in the cipher equivalent. The first is the one already 
pointed out, namely, that the 1st letter of the cipher equivalent is the same 
as the cipher letter immediately preceding it. The second characteristic is.,, 
the appearance of the two K c s at an interval of 3 spaces. (This is, of 
course, a function of the particular primary components used in this parti- 
cular encipherment; but it is desired merely to indicate a general principle 
at this point.) Hence, the word ARTILLERY is' idiomorphic in this case. 
Scanning the messages carefully, there will be encountered tho following 
additional sequences which can be assumed to be the cipher equivalents of 
ARTILLERY because they are isomorphic with' the YVTLKZEKUR sequence. Thus: 

■ • .ARTILLERY. 



r -D_D (JSSU NSFB 
In Message 1 . . . ) V V J LKZlf U R 

\k k u x L-'crirE w t 



In Message 2... IIXOZETZNK 



J 



In Message 3... VVJLKZEKUR* 

If this is correct, then, partial chains of equivalents in the primary cipher 
component may be constructed, by applying principles of indirect symmetry. 

In this case it actually happens that practically the entire primary cipher 
component may be reconstructed from tho relatively few data given by the 
superimposition of these hypothetical equivalents of tho single word 
ARTILLERY. Let the student confirm tho fact that the following sequence may 

g 

be derived from the data given: 

1 2 3 4 5 6 7 & 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
TEZKR.IVF. . . Q, . W G . ■ N U S B X J D 0 L 

g *— : • ! r ' 

The derivation is , of course, independent of the identity of the word which 
"the isomorphs represent. 
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The only missing letters are A, G, H, M, P, and Y. By testing the partial 
sequence to see if.it is a decimation of a keyword -mixed sequence, it is 
found that it is derived from the keyword HYl!)RAUliIC . Thus-, while analysis 
of the -relatively scanty individual frequency distributions, contained in 
Table 1 would be extremely difficult, if not impossible, . because of the 
paucity of data in the distributions, by app.lying the valuable tool of indirec 

symmetry, solution may be achieved in a relatively short time,. 

< 

f_. .If there is a largo amount of traffic in the samp, set of cipher 
alphabets, so that there, is no difficulty in selecting the cipher equivalent 
of a single letter , say 'EL, . in each dis tribut ion, , solution comes even more 
quickly than in the foregoing- example. 

£. Tho example solved in the foregoing subparagraphs, offers an impor- 
tant lesson to the student, insofar as it teaches him that he should, not 
immediately feel discouraged when confronted with a problem yielding only a 
small quantity of text and therefore affording what seems at first glance to 
be an insufficient quantity of data for solution . For in this example, 
while it is true that thero are insufficient data for analysis by simple 
principles of frequency, it turned out that solution was achieved without 
any recourse to the principles of frequency of occurrence- . Here, then, is 
one of those interesting cases of substitution ciphers of rather complex • 
construction which are solvable without any study whatsoever of frequency' 
distributions. Indeed, it will be found to be truo that in more than a few 
instances the solution of quite complicated cipher systems may be accomplished 
not by the application of the principles of frequency, but by recourse to in- 
ductive and deductive reasoning based upon other considerations, even though 
the latter may often appear to- be very tenuous and to rest upon quite flimsy 
SUppOrtS. • - . 
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h. Eefore leaving the subject of a general solution for cipher-text 
auto-keyed, cryptograms, a final, note may be added with regard to certain 
basic cryptographic phenomena in such cryptograms. In the illustrative 
example in subparagraph b_, the auto-keying sequence was offset but one letter 
to the right of the cipher text because the introductory key consists of but 
a single letter. Obviously, if the initial key consists of 2, 3, 4, ... 
letters, the subsequent auto-keying sequence will be offset 2, 3, 4,... 
letters to the right, respectively. This moans that in studying cryptograms 
of this nature the cryptanalyst .can make trials of frequency distributions 
of the type shown in Table I (page 51) at various intervals , in order to 
ascertain the length of the introductory key. Only when the proper interval 
is tried will the distribution bo monOalphabetic . For example, in the illus- 
trative case in subparagraphs b_ and c_, the distribution is based upon the 
cipher letter immediately following each appearance .of ' the’ coordinate letter. 
This interval (1) is correct in that case because the introductory key con- 
sists of one letter. But suppose the introductory key consisted of 2 letters. 
Then a distribution based upon the letter immediately following each appearance 
of the coordinate letter would no longer show monoalphabeticity, since the 
interval selected is not correct. In this case the distribution would have 
to be based upon the second letter after each appearance of the coordinated let- 
ter }■. and then the distribution would show monoalphabeticity. Likewise, if 
the introductory key consisted of 3 letters, the distribution would have to 
be based upon the 3d letter after each appearance of the • coordinate letter, 
and so on. 

_i. Another point is of interest in connection with the external 
characteristics of repetitions in cryptograms of this nature. In subparagraph 

3 : r " ■ • "• " v • ' 

By coordinate letter is meant the letter to the left of the square which is 
actually the key letter. 
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d_ certain characteristics were pointed out as regards the presence of double 
letters in, the, cipher text. It is to be noted that in that case the intro- 
ductory key consists of but one letter, so that whenever the letter Ap 

occurs in the plain text there is a double letter in the cipher text. But , 

■ • * • • . *..* -s 

suppose the introductory key consisted of 2 letters. Now note what happens, 

using the same, example as in d_, but with introductory key XT. 

Key XYST W C U Y N ‘ - 

Plain. ... M A K il A T T A N 
Cipher. . . E Y I C i l 1? I R 

It will be seen that the letter A^ no?; produces a repetition of the pattern 
ABA, where A and B may be any letters. (Note WQW and YNY in the example.) 

If, the introductory key consisted of 3 letters, then the presence of A 



would produce a repetition of the pattern ABCA, and so on. 

■ J-T . Finally, the number of times patterns of the types indicated 
occur in specific cryptograms (AA, when the introductory key is one letter; 

, .i . ■ ' . 

ABA, when it is 2 letters; ABCA, wh$n- it is 3 letters, etc.), may be used 
as a basis for ascertaining the "base letter" in encipherment. Ey this is 
meant that, if .for example, the primary components are set so that 8 k is 

opposite A , (base letter is A) and if . the introductory key is say 2 letters 

' ■■■' P- V' 

then the number of times the pattern ABA occurs in the cryptogram corres- 



ponds .with the frequency of Ap. If the cryptogram contains 1000 letters, 
there should then be about 72 occurrences of the pattern ABA, since in 1000 
letters of plain text there should be about 72 A’s. If the' base letter is 
Tp, then there should be about 90 occurrences, of the pattern ABA, and so on. 
When the base letter has been ascertained by such a procedure, it is 
immediately possible to insert the corresponding plain-text letter through- 
out the text of the message. ...The distribution, of. this letter may not, only 
serve as a check (if no inconsistencies develop) but .also may lead to the 
assumption of values for other cipher letters.. 
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26. Special case of solution of cipher-text auto-keyed cryptograms. - 
a. !flwo. messaged' with; identical plain texts but different initial keywords 
(but of 'the same lengths can be solved very rapidly by reconstructing the 
‘ primary components". ?The cryptographic texts of such messages will be. iso- 
morphic after the' initial keyword' portions . -Note the two following super- 
imposed messages,' in Much only a few identities have been indicated:. • 

TS'BJS K B N L 0 C F H A Z L W JAM B N F N S MVJRE 

BKKMJ X Y C X B' H R P V 0 X M U V I Y C R C G I KU T D 




HFPRX CPC R R EH. F M U HRAXC NFDUB ATFQR, 

PIE T N P I EH TJT DP R I W P TV N II C R S W Y V J R FT ' 

Starting with' any pair of superimposed letters . (beginning' with. the' ninth) , 

chains of equivalents are constructed: 

123456789 10 11 12 13 14 

1.. . LXNCHPEDS G . . . . 

2.. .0.Y... 

3. . . q F R T J U W M I . -. . 

4.. . A V K* . . . 

By interpolation, these partial sequences may be united into the keyword 
sequence: 

HYDRAULIC B E F G J K M N 0 P q S T V W X (Z). ' 
b_. The initial keywords and the plain texts may now be ascertained 
quite easily by deciphering the messages, using this primary component slid 
against itself. 

c_. The foregoing solution affords, a clue to the solution of cases in 
which the texts of two or more messages are not completely identical but are 
in part identical because they happen to have similar beginnings or endings, 
or contain nearly similar information or instructions. The progress in such 
cases is not so rapid as in the case of messages with wholely identical texts 
because much care must' be exercised in blocking out the isomorphic sequences 

4 ~ ’ 1 ’ ' ' ' ’ : ’ ’ 7 ' 1 

Two messages having identical plain texts and different length keywords can 
also be readily solved, but the procedure is more involved. 




REF ID:A4146453 

- 58 - 

upon which, the. reconstruction, of the primary components will, be based. 

cL. . (1) In the foregoing cases, :the primary components used to encipher 

the illustrative messages were identical mixed sequences. If non-identical 

components are employed, the cryptograms present an interesting case for the 

5 

application of a principle pointed out in a preceding text . 

■ (2)- Suppose .that the. three messages of Par, 251? had been encipher- 
using a plain component 

ed by/different from the mixed component. The encipherments of the word 
ARTILLERY. would still- yield isomorphic sequences, from which, as has been 
noted, the reconstruction. of the cipher component can be accomplished. 

(3) Having reconstructed the cipher component (or an equivalent) 
the latter may be applied to the cipher text and a "decipherment" obtained. 

In this process any sequence of 26 letters may be used as the plain component 
and even the normal sequence A. , .Z may be employed for this purpose. The wc.ru 
decipherment in the next to the last sentence is enclosed by quotation marks 
because the letters thus obtained would not yield plain text, since the real - 
or an equivalent plain component has not yet been found. Such "deciphered" 
text may be termed spurious plain text. But the important thing to note is 
that this text is now monoalphabet ic and may be' solved by the simple procedur e 
usually employed in solving a monoalphabotic cipher produced by a single 
mixed alphabet . Thus, a polyalphabetic cipher may be converted to monoalpha- 
betic terms and the problem much simplified. In other words, here is another 
example of the situations in which the principle of conversion into mono- 
alphabetic terms may be applied with gratifying success. It is also an exampl 
of the dictum that the use of two differently-mixed primary components does 
not really give much more security than does a mixed component sliding against 
itself or against the normal sequence. 

5 

Military Cryptanalysis, Part I, Par, 45. 
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•' ■ ; section vii. 

' SOLUTION OF AUTO-KEF SYSTEMS, II. 

Paragraph 

Preliminary remarks on plain-text auto-keying...'. 27 

Solution of plain-text auto-keyed cryptograms when the ' , 

introductory key is a single letter . 28 

Mechanical solutions. 29 

.27. Preliminary remarks on plain-text auto-keying. - a.. If the cipher 



alphabets are unknown sequences, plain-text, auto-keying gives rise to cryp- 
tograms of more intricate character than does cipher- text' auto-keying, as 

has already been stated. As a cryptographic principle it is very commonly 

\ 

encountered as a new and remarkable "invention" of tyros in the cryptographic 
art. It apparently gives rise to the type of reasoning to which attention 
has been directed once before and which was then shown to be a popular delu- 
sion of the uninitiated.. The novice to whom the auto-key principle comes as 
a brilliant flash of- the imagination sees only the- apparent impossibility of 
penetrating a secret which enfolds another secret. His reasoning runs about 
as follows: "In order to read the cryptogram, the would-be solver must, of 

course, first know the key; but the key . does not become, known to the would- . 
bo solver until he has read the cryptogram and has . -thus f ound the plain text. 
Since this is reasoning around a circle, the. system : is. indecipherable." How 
unwarranted such reasoning really is in this case, and how readily the problem 
is solved, will be demonstrated in the next few paragraphs. , . 

_b. The discussion will, as usual, be divided into, two principal 
cases: (l) when the cipher alphabets are known and (2) when they are unknown. 

Under each case there may be an - introductory key consisting .of a single letter 
a word, or a short phrase.-' The single-letter initial key will be treated 



first 
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28. Solution of plain-text auto-keyed cryptograms when the introduc- 
tory key is. a single .letter. -'-.a. Note the following plain-text auto-keyed 
encipherment of such commonly encountered plain-text ’words as COMMANDING, 
BATTALION, and DIVISION, using direct standard alphabets,. 



( 1 ) 

(3) 



BATTALION 
BTMTLTW. B. 

G 0 M. M ANDING 
Q, A Y M N Q, L V T 



( 2 ) 



DIVISION 
L D D A A W B 



..CAPTAIN 
] C-P I T I V 



These characteristics may be noted: • . . 

(1) The cipher equivalent of A is the plain-text letter which 



immediately precedes A . (See the two A' s' :n BATTALION, for 1 above). 



(2) A plain-text sequence of the general formula ABA yields a 
doublet as the cipher equivalent of the final two' letters. (See TVI 
or IS I in DIVISION, - example 2 above.) 

(3) • Every plain- text trigraph having A^ as its central letter 
yields a cipher equivalent the last two letters of which are identical 
with the initial and final letters of the plain-text trigraph.., (See 
MAN in COMMANDING, example 3 above.) 

(4) Every plaintext tetragraph having A as the initial and the 

B 

final letter yields a cipher equivalent the 2d and 4th letters of which 
are identical with the 2d and 3d letters of the plain-text tetragraph, 
respectively. (See APTA in CAPTAIN, example 4 above; also ATTAin 
BATTALION, example 1. ) 

b_. (1) From the foregoing characteristics and the fact that a repeti- 

tion of a sequence of n plain-text letters will yield a repetition of a 
sequence of n-1 cipher letters, it is obvious that the simplest method of 
solving this type of cipher is that of the probable -word. . Indeed, if the 
system were used for regular traffic it xvould not be long before the, solution 
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would consist merely in referring to lists of cipher equivalents of common- 
ly used words, (as found from previous messages) and searching through the- 
messages for these cipher ' equivalents,. . • r •• 

(2) Note how easily the following message can be. solved: 

B E C J I ' B T MTL T W B P Q, . A Y M -N- Q, H V N E T W A A L C. . 
Seeing the sequence BTMTLTWB, which is on the list of equivalents in. a_ above 
(see example 1), the word .BATTALION is inserted in proper position. - Thus: 

BEC JI BTiTL ■ TIIBPq . .. - 

....B ATTAL ION.*... 

With this as a start, the decipherment may proceed forward or backward with 
ease. Thus: - ' 

BECJI BTMTL TWBPQ A Y M N Q, H? NET WAALC 

EACH B-: ATTAL IONCO M MAUD ERWIL L P LA'C . . 

o_. The foregoing example is based upon, the so-called- Vigenere method 
of enciphermont (0 k / c =>■ ©i/p > Qp/p = ^c/c^* in encipherment the plain- 
text letter is sought in the- cipher component, its equivalent taken in the 
plain component • = @i/-p' ^p/c ~^c/p^*' stops -in solution are -iden- 

tical, except that the' list of cipher . equivalents of probable words must be 
modified accordingly. For instance, BATTALION will now be enciphered by 

the sequence ZTAHLXG-Z. 

d. If reversed standard cipher alphabets are used, the word BATTALION 

will be enciphered by the sequence - . BHATPDUB 

which also presents idiomorphic characteristics leading to" the easy recogni- 
tion of the word. > 

e_. All the foregoing phenomena are based upon standard alphabets, but 
whenmixed cipher components are used and these have been : reconstructed,, 
similar observations may be recorded and the results employed in the solu- 
tion of additional messages enciphered by the same components. How messages 
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enciphered by unknown mixed components may be solved will bo discussed. • 
presently. At this point it will merely bo noted that repeated plain-text 
sequences of n_ letters produce repetitions- of -n-1 letters in the cipher 
text. Frequently-repeated trigraphs and tetragraphs, such as ENT, ING-, ION, 
SION, TION, will produce repetitions of digraphs and trigraphs in the cipher 
text-, so that, in addition- to such. repetitions of long words ; as are commonly 
encountered in .'military text, there will be plenty of shorter repetitions 
which will yield useful data. Inasmuch as the principles underlying the steps 
to be followed after the repetitions have been found are quite similar to 
those set forth under Pars. 25 and 26, in connection with cipher-text auto- 
keying, no example will be necessary at this point. 

29. Mechanical solutions. — a. The method of solution pointed out in 
the preceding paragraph is based, upon the successful application of, the 
probable-word method. But sometimes the latter .method- fails because the 
commonly-expected words may not be present after all. Hence, other 1 principles 
and -methods, .preferably mechanical in character and not dependent upon assum- 
ing the presence of any specific words may be desirable, One such method 
will now be described. The. matter will be presented under separate headings, 
dependent upon the types of primary components employed. 

_b. ; The types of primary components may be classified as follows: 

(1) Primary components are identical. 

(a) Both components progress- in the same direction, 

(b) The two components progress in opposite directions. u 

(2) Primary components are different. - 

£. (1) Taking up the case wherein the two identical, primary compo- 

nents progress in the same direction, assume the following additional- factors 
to be known by the. cryptanalyst: 
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(a) The primary components are both normal sequences, 

(b) The encipherment is by plain-text auto-keying, 

(c) The enciphering equations are: ^k/c = ^i/p> $p/p =9c/c' 

(2) A message beginning QVGLB TPJTF ... is intercepted; the only 

unknown factor is the initial keyletter. Of course, one could try to decipher. 

the message using each keyletter in. turn, beginning with A and continuing 

until the correct keyletter is tried, ' whereupon plain text will be obtained. 

But it seems logical to think that all the 26 possible "decipherments" might 

be derived from the first one, so that the process might be much simplified, 

and this is true, as will now be shown. , Taking the two cipher groups under 

consideration, let them be "deciphered" with initial keyletter A: 

Cipher QyGLBTPJTF 

Deciphered with keyletter A C^BKRCNWXI 

The deciphered text is certainly not "plain text." But if one completes 
the sequences initiated by these letters, using the direct standard sequence 
for the even columns, the reversed standard for the odd columns, the plain 
text sequence is seen to reappear on one generatrix: It is HOSTILE FOR ( CE) . 

From this it appears that instead of going through the labor of making 26 
successive trials, which would consume considerable time, all that is neces- 
sary is to have a set of strips bearing the normal direct sequence and another 
set bearing the reversed normal sequence, and to align the strips, alternately 
direct and reversed, to the first "decipherment." The plain text will now 
reappear on one generatrix of the completion diagram, - 
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Initial < 

key 

letter Q, V G LB TP I T F , . .. . 

Q F B K R C.N W X .1 
P G A L 0, D M X VJT J 
OHZMPELYVK 
N I Y NO FKZUL 
MJXONGJATM. 

L K W P M H "I B S'N 

. K L V Q, L . I H C R 0 . 

JJfiURKJGD Q P 
I N T S J K F E P Q . 

"H O S T I L .5 FOR* 

-G P,R U H MGG.NS 
F Q, q V 'G N C H M T 
ERPWF.OBILU.. 

DS OX E PA J. K V 
CTNY.DQZin 
BUMZO R Y L I T 
A V L: A B S X M..K Y 
Z V! K B A T W H G Z ' 

YXJC ZUVCFA 
XYIDYVUPEB 
W Z H E X ¥/ T Q, D C ' 

V A G F W X S R C D 
UBFGVYRSBE 
TCEAUZQTAF 
SDD ITAPUZG 
RECJSBOVYK .... 

Figure 8, 

(3) Tine peculiar nature of the phenomenon just observed, viz , a 
completion diagram with the vertical sequences in adjacent columns progress- 
ing in opposite directions, those in alternate columns in the same direction, 
calls for an explanation, . Although .the. matter, seems rather mysterious, it 
will not be hard to understand, First, it is not hard to see why the letters 
’in column 1 of Fig. 8 should form the descending sequence QPO... for these 
letters are merely the ones resulting from the successive "decipherment" of 
Q c by the successive keyletters A,B,C,....« Now since the "decipherment" 
obtained from the 1st cipher letter in any row in Fig. 8 becomes the keylotte 
for "deciphering" the 2nd cipher letter in the some row, it is' apparent that 
as the letters in the 1st column progress in a reversed normal (descending) 



A 

B 

, . C 

D 

. E , 

F 

. , ■ G. 

H 

I , 
' J" 
K . 

L 

.. . M. 

N 
0 
P 

A 

R 
. S 
T 
U 

V 

\ w 

X 

Y 
Z 
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order, the letters in the 2d column must progress in a direct normal (ascend- 
ing) order. The matter may perhaps become more clear if encipherment is 
regarded as a process of addition, and decipherment as a process of subtrac- 
tion. Instead of primary components or a Vigenere square, one may use simple 
arithmetic, assigning numerical values to the letters of the alphabet, begin- 
ning with A - 0 and ending with Z = 25. Thus on the basis of the pair of 
enciphering equations 9 k ^ c = ®i/p> ®p/c = ®c/c> ^he l^ter Hp enciphered by 
keyletter M k with direct primary components yields T c . But using the follow- 
ing numerical values: 



ABCDEFGHIJ K L M'N 0 P 0, R S T U V W X Y Z 

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 

the same result may be obtained thus: Hp(M k ) = 7 12 = 19 = T c . 

Every time the number 25 is exceeded in the addition, one subtracts 26 from 

it and finds the letter equivalent for the remainder. In decipherment, the 

process is one of subtraction. For example j 

T c (M k ) = 19 - 12 = 7 = H p ; D c (R k ) =3-17 £ [(26 4 - 3) -17] - 29 - 17 - 12 = M p 
Using this arithmetical equivalent of normal sliding-strip encipherment, the 
phenomenon just noted can be set down in the form of a diagram which will 
perhaps make the matter clear. 



q V G L B T P J etc . 

Q, c (A k ) = 16-0 - 16 = Q, ^ q F B K P. . \ . , 

. '> 4 '(■ * 



= 21-16 = 5 = F .. 
G c (F k ) = 6. - 5 = A » B .. 
L^Bfc) = 11-1 = 10 = K . 

B c (K k ) = 1-10 = 17 , S . 



4 



• i 



» » i i I 

********************** 
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OcfB^) = 16-1 = 15 
V c (P k ) = 21-15 =6 
G c (G k ) = 6-6 « 0 

^ c (\) = 11-0 z 11 
B c (l lc ) = 1-11 = 16 
* * * * * * * 

Q, (C ) = 16-2 - 14 
e c 

V c (0 k ) :: 21-14 = 7 = 
G c (H k ) = 6-7 = 25 = 

L 2 ( Z^) - 11-25 = 12= 
B c (M k ) - 1-12 = 15 = 
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P P G A L Q . . . 





Note how homologous letters of the three rows ( joined by vertical dotted 
lines) form alternately descending and ascending normal sequences. 

i ... , ’ . N • 

(4) When the method of encipherment based upon enciphering 

equations G k y c r0i/p>0p/c -Qc / p usec * instead of the one based upon 

enciphering equations^ k ^ ■- Q .y^ ; Q = ^c/c* P rocess indicated above 

is simplified by the fact that no alternation in the direction of the sequences 

in the completion diagram is required. For example: ^ 

Cipher. ............ .Y H E B P D T B J D 

Deciphered. A. = A . ... YJT J K Z C V W F I 

ZGKLADWXGJ 
A H L M B E X Y H K 
BIMNCFYZIL 
C J N 0 D G Z A J M 
. DKOPEHABKN 
ELPQFIECLO 
FMQRGJCDMP 
GNRSHKDEN Q - 
; HOST I L E F 0 R 

. d. (1) In the foregoing example the primary components were normal 
sequences, but the case of identical mixed components may be handled in a 
similar manner. Note the following example, based upon the following 
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primary component. (which is assumed to have, boon reconstructed from previous 
work) : 

IBP YR C.Q. Z I GS.EH TD JJMKV A L IV N OX 
Message: US IHL Y ^ E 0 P ...etc. 

(2) First, the message is '’deciphered" with the initial key-letter 
A,. and then a completion diagram is established, using sliding strips bearing 
the mixed primary component, alternate strips bearing the reversed sequence. 



Note Fig. 9, in which the plain text, HOSTILE 
FOR(CE), reappears on a single generatrix.- Note 

ir y 

also that whereas in Fig. 8 the odd columns con- 
tain the primary sequence in the reversed, , order, 'smd. 
the even columns contain the sequence, in the 
direct order, in Fig. 9 . the situation is rover-,. . 

sed; the,, odd .columns contain the primary se- . 

and 

quence in the direct order, /the even columns 
contain the sequence in. the reversed order. • 

This point is brought to notice to show that it . 
is immaterial whether the direct order is used 
for odd columns or for even columns; the a lter - 
nation in direction is all that is required in . 
this typo of solution. 

e_. (l) There is next to be considered 

the case in which the two primary components - 



US INLY Q E 0 p . 
W D A Y K E L U-I A' 
NT LPVSJJSV. 
0 H W B A G. N-D S.K 
X E NF L I 0 T E M 
F S 0 X W.-Z-X H-H U 
B G X 0 N Q'>.,E-T J 
P IENOC B.SDD 
Y ZBWX-RP G-J T. 
RQPLFYYIUH 
C'C Y A B P.R Z M E 
iRR V P B C Q K S 
Z.Y CKYF-QCVG- 
IPPRXZRAI 
GBZUCO.IYLZ 
S F I J Q N G P W Q, 
E X G D Z VI S B - N C 
HOSTILEFOR 
TNEHGAHXXY 
DWH E S V T OF P 
JLTSEKDNBP 
U A D GHMJWPI 
M V'J I TU-UL YX 
K K U Z D J K A R 0 
VMM Q I D K V C N 

'AUKCUTVKqi 
L J-V R M,H A M Z L 

jTiUTiTit 

Figure 9. 



progress in opposite directions 



[Par.,29b(l)(b)]. 



.Here is a message, knovm 



to have been enciphered by reversed standard alphabets, plain- text auto- 



t S" 

keying having been followed: 



XTWZLXHZRX 



C 
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XT W"Z LX HZ R X 
CJNODGZA JM 
DKOPEH ABEN 
ELPOJIBCLO 
FMQRGJCDMP 
GNRSHKDENQ 
HOST'ILEFOR 
IPTU.LMJGPS 
J Q U V'K IT' G H a T. 
KRVWLOHIR. U 
L S W IMP f J' S V 
M T X Y N 0 J K T W 
N U Y Z 0 R K L U X 
0 V Z A P SLM .VY 
P W A;B..n T-.M N; W Z 
q X B.C RUN O/X A 
R Y C D S'. V. O'P.Y 3 
S ZD E T UP 0 Z C 
T A E. F.U X O R A D. 
U BF G V Y R S 3 E' 
V C G H If Z S T'C F 
W DH IX ATUDG . 
X El JY B'U V E H 
YF J K Z C V W F I 
Z G K L A D'H G J 
A H L M 'B ’E X Y' H K 
B IM B C F Y Z I L 

Figure lo. ■ 



(2)' The procedure in this case is exactly 
the same as before, except that it is not necessary 
'to have any alternation in direction of the comple- 
tion sequences, which may be' either that of the 

• . . - , . . . - . e , . ' 

plain component or the cipher component. Note the 
solution in Fig. 10. Lot the student ascertain why 
the alternation in direction of • the completion 
sequences is not necessary in this case. 

(3) In the foregoing 'case the alphabets' were 
reversed ‘standard, produced by the sliding of the 
normal sequence against its reverse. -But the under- 
lying principle of solution is the same even if a 
mixed' sequence were used instead of the normal; so 
long as tho sequence is known, the procedure to be 
followed is exactly the -same as demonstrated in sub- 



paragraphs (1) and (2) hereof. Note the following solution:- . 

Message^ . : V D D II C T S E P A . . . 

Plain component- . . F B P Y R C q Z I G S E H T D J U M K V A L V, r N 0 X 

Cipher component X 0 N W L A V K M U J D T H E S G I Z q C R' Y P B' ! 



Note here that the primary mixed sequence is used for the completion .sequence 



and that . the plain text, HOSTILE FOR(CE), comes out on one' generatrix. ' -It is 
immaterial whether the direct or reversed mixed' component is used for. the 
completion sequence,, so long as all the sequences in the diagram progress" 
in' the. same direction. (See Fig. 'll. ) ' ; ' 
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"jq 


'Figure 


n. 







f. (1) There remains now to be considered only the case in which the 

two components are different mixed sequences. Let the Wo primary components 

be as follows : 1 

Plain A B C :D E..F G H I. J K L M N 0. P Q R S T U Y W X Y Z 

Cipher. FBPY R'C q Z I G S E HTDJUMKV A L W N 0 X 

and the message: ’ 

... / ... 

: 'C F UYL V X U D J 

(2) First "decipher" the message with any arbitrarily selected 
initial keyletter, say A, and complete the plain component sequence- in the 
first' column. (Fig.. 12a) 




Cipher. .. CFUYLVXUDJ 

Plain LFQXWXAW5F 

M 

N 

0 

P 

Q, 

R 
S 
T 
U 
V 
W 
. X 
. Y 
Z 
A 
B 
C 
D 
E 
F 
G 
H 
I 
J 
K 

Figure 12a. 
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CFUYLVXUDJ 
L F Q, X W X A W S E 

■' 

~ • ND 

,oc 

. ' . P Y 

f " Q, u 
. k w 
' : "s o, 

T N 

' . " . , U K 

. V H 
'.WE ' 

X B 

. y x 

■ .. ■■ ZT 

' ■ . 1 . ' AG 
BZ 

. C Y 

''DM 
.. V ' . E P 

FA 
G R 
• K 0 
'■I S 
J L 
K I 

' Figure 12b_ 



Now prepare a strip bearing the cipher component reversed , and set it below 
the plain component so that Fp - Lj, , a setting given by the 1st two letters 

i . •. * * ’ ... 

of the spurious "plain text" recovered. Thus: 

Plain ABCD EF GHI JKLMNOPQRSTUVWXYZ 

Cipher. . . F X 0 N W L A V K M U J D T H E S G I Z Q C R Y P B ' 

(3) Now opposite each letter of the completion, sequence 'in; 
column 1, write its plain-component equivalent, as given by the juxtaposed 
sequences above. This gives what is shown in Fig. 12b_, Then reset the two 
sequences (reversed cipher component and the plain component) so that 
Qp. s F 0 (to correspond with the 2d and 3d letters of the spurious plain text) 
write down the plain-component equivalents of the letters in column 2, form- 
ing column. 3,. Continue this process, scanning the generatrices from time 

t : - 

to time, resetting the two components and finding equivalents from column to 
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column, until it becomes evident on what genera- 


C 


F 


U 


Y 


T 

XJ 


V X U D T 




L 


F 


A 


X 


JtL 


X A W S' E 


trix the plain text is reappearing. In Fig. 12c_ 


M 


J 


B 


c 








N 


D 


C 


Y 






it is seen that the plain text generatrix is the 


0 


C 


L 


I 








P 


Y 


N 


a 






one beginning HOST, and from this point on the 


Q 


U 


A 


j 








R 


W 


U 


N 






solution may be obtained directly, by using the 


S 


0. 


K 


L 








T 


N 


T 


Q 






two primary components. 


U 


K 


Y 


A 








V 


H 


E 


S 






(4) When the plain component is also 


W 


E 


F 


D 






. . . . 


X 


B 


P 


B 






a mixed sequence (and different from the cipher 


Y 


X 


R 


Z 








Z 


T 


D 


P 






component), the procedure is identical with' that 


A 


E 


H 


R 






B 


Z 


J 


0 






outlined in subparagraphs ( 1 ) — ( 3 ) above. The 


C 


V 


X 


E 








D 


M 


Z 


W 






fact- that the plain component in the preceding 


E 


P 


0 


F 








F 


A 


w 


H 






case is the normal sequence is of no particular 


G 


R 


M 


M 








H 


0 


s 


T 


* 




significance in the solution, for it acts ns a 


I 


S 


G 








..... .. 


J 


L 


V 








mixed sequence would act under similar circum- 


K 


I 


I 








stances. To demonstrate, suppose the two follow- 




Figure 


12c.. 



ing components were used in encipherment of the message below: 



Plain WBVIGXLHYAJZMNFORPEQDSC T K II 

Cipher F.B P.Y R: C’ Q ZIGSE H T D J D M KVA LINO X 

Message ... BB7ZU D Q X J D ... 

To solve the message, "decipher" the text with any. arbitrarily selected 

initial keylettcr and proceed exactly as in subparagraphs (2) and (3) above 

Thus: Cipher .• B B V Z U D 0, X J D ' . 

. "Plain" (@ k= X) . ... V Y R I Y Z E F 0 R 

Note the completion diagram in Fig. 13 (page 72), which shows the word 

HOST... very soon in the process. From this point on the solution may be 

obtained directly, by using the two primary components. 
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BBVZUDQXJD 
VYRIYZEFOR 
I Q, N J 
Gl'YG 

x v w z 

LLKO 

HOST* 

Y K B 
A H H 
J M V 
Z D X 
MJG 
N G J 
F B E 
0 I Z 
R T L 
P U I 
E R 0 
Q S A 
D N C 
S P P 
C G F 
T F Q 
K A U 
UZM 
WXD 



Figure 13. 



£. (1) Another "mechanical" solution for the 

foregoing cases will now be described because it 

presents rather interesting cryptanalytic sidelights. 

Take the message REFERENCE HIS 

PREFERENCE IN REFERENCE 

BOOKS AND REFERENCE C H A R T S -r. 

tod encipher it by plain-text auto-key, with . 

normal direct primary components, initial key setting 

A s G . '^'hen note the underscored repetitions: 

pc , , 

REFERENCEHISPREF ERENC E'IN 
X VJJVVRPG L P A H G V J J V V R P G MV 

REFERENCE BOOK S' AND REFERENCE 
E VJ JVVRPS FPCYCSNQU VJJVVRPG 

CHARTS 

GJHYKL 

Now suppose the message has been intercepted and is to 



be solved. The only unknown factor will be assumed to be the initial, keyletter 
Let the message be "deciphered" by means of any initial keyletter, say A, and 



then note the underscored repetitions in the spurious plain text. 

Cipher ..... X VJJVVRPG LP AEG V- J. J V V R P G M V E V JJ V 

"Plain text" . . . X Y L Y X Y T- W K B 0 M V LKZKLKHIY 0 H X Y L Y X 

V R P G FPCYCSNQU V J J'TVRP G GJHYKL 

Y T ff K VUIQMGHJ LKZKLKH I Y I B G S S T 

The original four 8-letter repetitions now turn out to be two different sets 
of 9-letter repetitions, which seems rather peculiar. But now let the spurious 
plain text with its real plain text, and the cipher text, be transcribed as 

though one were dealing with a periodic cipher involving two alphabets, as. 

shown herewith. It will here be seen that the letters in column 1 are mono- 
alphabetic, and so are those in column 2, In other words, an auto-key cipher, 
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which is commonly regarded as a polyalpha- 


1-2 


1-2 


1-2 


1-2 


betic, aperiodic cipher, has been converted 


R S' 


E F 


R E 


E- F 


into, a.' 2-alphabet, periodic cipher, the indi- 


-X Y 

; . \ 


K Z 


X Y 


KZ 


vidual alphabets of which are now monoalpha-- 


' PE ; 


E R 


N C 


' E R 


betic in- nature. The two repetitions^ of 


. L Y • 


K L ' 


T W 


' K L 


X Y L Y : X : Y T W; K represent encipherments ■ 


' R E 


' E N 


E B 


E'N 


of the word REFERENCE, in alphabets 1-2- 


X Y 


K H 


K V 


K H 


1-2-1-2-1-2-1; the two repetitions of 


N C 


C E 


0 0 


C E 


LKZKLKHIY likewise represent en- 


T W 


I Y 


U I 


I Y 


cipherments of the same word but in alpha- 


E H 


I N 


K S 


C H 


bets 2-1-2- 1-2-1-2-1-2. 


K B 


0 H 


Q, M 


I B 


(2) Later on it will be seen how 


I s 


R E 


A N 


A R 


this method of converting an auto-key cipher 


0 M 


X Y 


a h 


G S 


into a periodic cipher may bo epplied to the 


P R 

* l 


F E 


DR 


T E 


case where an introductory keyword is used 


Y L 


L Y 


J L 


S T 



as the initial keying element instead of a single letter, as in the present 
case. At this point let the student try to figure out for himself the basis 
for the phenomena demonstrated above. A hint will be found be referring to 
the case described under c_ under this paragraph., 

h.. (1) In the foregoing case the primary components were identical 

normal sequences progressing in the same direction. If they were mixed 
sequences the phenomena observed above would still hold true, and so long as 
the sequences are known, the indicated method of solution may be applied. 

(2) When the two primary components are known but differently 
mixed sequences, this method of solution is too involved to be practical. It 
is more practicable to try successive initial keyletters, noting the plain text 
each time and resetting the strips until the correct setting has been ascertain 
ed, as will be evidenced by obtaining intelligible plain text. 
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SECTION VIII . 

SOLUTION OF AUTO -KEY SYSTEMS , III. 

Paragraph 



Solution of plain-text auto-keyed cryptograms when the 

introductory key is a word or phrase 30 

Subsequent steps after determining the length of the 

introductory key . 31 . 

Conversion of foregoing aperiodic cipher into periodic form ... ■ 32 

Concluding remarks on auto-key systems 33 



30. Solution of plain- text auto-keyed cryptograms when the introductory 
key is a word or phrase. - a_. In the foregoing discussion of plain-text 
auto-keying, the introductory key was assumed to consist of a single letter, 
so that the subsequent lceylettors are displaced one letter to the right with 
respect to the text of the message itself. But sometimes .a word or phrase 
may serve this function, in which case the subsequent key is displaced as 
many letters to the right of the initial plain-text letter of the message as 
there are letters in the initial key. This will not, as a rule, interfere in 
any way with the application of the principles of solution set forth in Par. 28 
to that part of the cryptogram subsequent to the introductory key, and a solu- 
tion by the probable-word method and the study of repetitions can be reached. 
However, it may happen that trial of this method is not successful in certain 
cryptograms because of the paucity of repetitions, or because of failure to 
find a probable word in the text. When the cipher alphabets are known there' 
is another point of attack which is useful and interesting. The method consists 
in finding the. length of the introductory key and then solving by frequency 
principles. Just how this is accomplished will now be explained. 

_b. Suppose that the introductory keyword is HORSECHESNUT, that the 
plain-text message is as below, and that identical' primary components 
progressing in the same direction are used to encipher the message, by encipher- 
equation © k / c - $ i/p p/p = @ c / c « Let the components be -the normal sequence 
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1 2 3 4 5 6 7 8 9 10 11 12 13 
Key. ... .HOESECHE'S T N U T 

Plain. .MYLEFTFLA N K I S 

Cipher. T M C W J V M P S G X C L 

Key. . . .R ECEIVING H E A V 

Plain. .Y .ART ELLER Y F I R 

Cipher. P E T X Q G T R X F J I 'M 

Key. , . .E E"N E M Y I S M A SSI 

Plain. ,N GTR.OOPS.T 0 L E F 

Cipher ,R K G V' A M X K F 0 D W N 

Key. .'. .T F R 0 N'T AND C 0 N C 

Plain. .ENT RATING A R T I 

Cipher .X S K F N" M I" A J C F ' G K 

Key LLERYTHER E X W I 

Plain.. L L N E E D C 0 N S I D E.. 

ipher.W WRVCWJSE W F Z M 

Key. ...RA BLEREIN'F' OR C 

Plain.. E MEN. TSTOM 'A I N’ T 

Cipher .V M F Y X J X W Z F W E V 

It will now be noted that sine 



14 IS.' 16 17 18 19 20 21 22 23 24 25 26 
M Y L E F .T F L A N K I S 

R E C E I V I., N G H E A V 

D C N I N O N Y G U 0 I N 

Y A R T ILLER Y F IR 

E E N E M . Y I S M A S S . I • . 

C E -E X U J T W D Y X A Z' 

N G T R 0 0 P S T 0 L E F 

, T F R 0 N ,T A N D C .0 N. C 

GLKFBHPFW Q Z R H 

E N T R A T I N G ART I 

;L ..L E. R Y T H E R E, .X W . I 

?" Y X I Y M P R X E 0 P Q, 

LLNEEDCONSID E 
R A; B L E. RE I NFO RC 

C L 0 ' P . I U G W A X 1 U G 

E M E N T S T 0 M A I . N 1 ' T 

A. I N M Y P 0 S I T I 0 N 

E U R Z R H H G U T Q B G 

e the introductoiy key contains 13 letters 




the 14th letter. of the message is enciphered by the 1st letter of .the plain 
text, the 15th by the 2d, and so on. Likewise, the 27th letter is encipher 
ed by the 14th, the 28th by the 15th, and so on. Hence, if the 1st cipher 
letter is deciphered, this will give the key for deciphering the 14th, the 



latter will give the key for the 27th, and so on. . An important step . in 
the solution of a message of., this kind would therefore involve ascertaining 
the length of the, introductory key. This, step will now be explained. . 



c_. Since the plain text itself constitutes the keylotters in this 
system (after the introductory key), these keyletters will occur with their 
normal frequencies, and this means that there will be many occurrences of 
E, T.», 0,. A, N, I, ,R, S' enciphered by E^;. there will be many occurrences 



of these, same high-frequency letters enciphered by T^, by 0^, by A^, and 
■ so -on. In fact, the number of times ’each of these combinations will occur 
may be calculated statistically. With the enciphering conditions set forth 



REF ID : A4 1 46453 

- 76 - 



under _b above'*' E enciphered by T k , for. example, will yield the same cipher 
equivalent' as Tp enciphered by E^; in other words two enc iphorments of any 
pair of letters of which either may servo as the key for enciphering .the other 
must yield the same cipher resultant. It is the cryptographic effect of those 
two phenomena working together which permits of ascertaining the length of 
the introductory key in such a case. For eveiy time a' given letter., 0p, occurs.' 
in the plain, text i;t will occur n letters later as a keyletter, 0 , and n in 
this case -equals the length of the introductory key. Note the following 
illustration: 



1 2 3 4 5 6 7 8 9 10 11 12 13 1 2 3 4 5 .6 7 8 9 10 11 12 13 

(1) Key. HORSECHE. S T N U T i T . . . . . . . 

(2) Plain T . . . .* .. . E . . . . . 

(3) Cipher^.. ......... ...... X ... . .' . . . 



123456789 

...'.. E ... . x . - 

T .' . :. 

X . . . 

Here it will be noted that Ep in line (2) has ’a Tp on either side of it, at a 
distance of 13 intervals; the first enc ipherment ( Ep by T^.) yields the same 



equivalent (X c ) as the second encipherment (T p by E k ) . Two cipher letters nro . 
here identical, at an interval equal to the length of the introductory key. But 
the converse is not true; that is, not every pair of identical letters in the 
cipher text represents a case of this typo. For in this system identity in 
two cipher letters may be the result of the following three conditions each 
having a statistically ascertainable probability of occurrence:' 

(1) A given plain-text letter is enciphered by the same key letter 
two different times, at an interval which is purely accidental; 
the cipher equivalents are identical but' could' not be used to 
■ give any information about the length of the introductory key. 



1 • 

It is important to note that the two components must be identical sequences 
and progress in the same direction. If this is not the case, the entire reason- 
ing is inapplicable. 
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(2) Two different plain-text letters are enciphered by two 

’ ' V ' 

different keyletters; the cipher equivalents are fortui- • . ■; 
tously identical, - 

(3) A given plain- text letter is enciphered by a given' key letter 
and later on the same plain-text letter serves to encipher 
another plain- text letter which is identical with the first - 
key letter; the cipher equivalents are causally identical. 

It can be proved that the probability for identities of the third type is 
greater than that for identities of either or both 1st and 2d types for that 
interval which corresponds with the length of tho introductory key ; that is , 
if a tabulation is made of the intervals between identical letters in such a 



system as the one being studied, the interval which occurs most frequently 
should coincide with the length of the introductory key. The demonstration 



of the mathematical basis for this fact is beyond the scope of the present 
text; but a practical demonstration will be convincing, 

d. Let the illustrative message be transcribed in lines of say 11, 12, 
and 13 letters, as in Fig. 14. 
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123456789 10 111233 
TMCf JV MP S G X CL 
DCNINONYGU OM 
P/fi)T(X)Q, G/TjR X F-JViJm 
‘ cl^Egcju JKS/W D Y X A Z 
R K GY AMXKFODWN 
G L/kYfMB HPFWQZRH 
X s[xj£)n/m\i A J C F G K 
P Y X I yIm/P RXEOPq 
WW RV C W JSEW F ZM 
CLOP I U G(F)A X/W\U G 
V M F Y X J Xf/Z F%/E : v 
EURZRHHGUTQBG 



c 



Figure 14 
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In each transcription, y 4f^eiy: pafft-d'^^UperMposed letters is noted and the 
number of identities' ifs indicated by ringing the letters involved, .As 'shown 

above. The^nmb^, of identities f ah' an assumed introductory.TTkey length 13 

• " ■' •' ■ , ; • • ■ . \ \ •• - ‘ ' . ■ . 

is 9,' as ;against:"3' for the Assumption of a key of 11 letters, and 5 for 

J#"-' . ■/ :■■■. : •' 

t^e As'sump^c[j^|oi A key of 12 letters. - 

a..-- Onoo having found the lopgth of the introductory key, two lines of 
attack aro possible* i the composition of the key may be studied* which'will . 



78 - 



yield sufficient plain text to g&t & start toward solution f jor - , the message 

may be reduced to periodic terms and solved A8 a' repeating^ey v :;cipherst.!t^’ 

'■Y'-'l •: ■" j . 

• • ' • ' ... ... ? ‘V " W# " 

first, ..line of attack will be diifeUssed first, it being e one tantly -borne in 
mind in this paragraph that the entire discuss ipn -is based ug@h the assumption 



that the cipher alphabets 6fe known alphabets » The i litis that ivfe mesa Age of % 
above will bo used, " 

31. Subsequent steps afte-f detei^iiniiig the length of |;he introductory 
key. - d. Assume that the first letter Of thA introductory key is A And 
decipher the 1st c.iphbf letter T^, (with direbt ||aiidard alphabets) ; ■ *This 
yields T afld ‘the latter becomes the key letter fop the 14th letter of the 
message. The 14th letter is deciphered: D^T^) | the latter becomes the 
keyletter for the 27th letter and so ph, down the .entire first column. of the 
message as transcribed in lines of 15 letters, fhe Same procedure is follow-. 

ed using B ai the. initial keyletter, then C,- and so .on. The message As it 

' , ; V ' " • •' ' •' ! : ’ ■ • ■ . : . . ’ ' 

appears- for the first three trials ( assuming A, B, then 0 as the initial key- 

-letfer) is Shown in Fig.- 15, (page 79), 
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123456789 
T M C W J V M P S- 
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• D 
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Gr • 
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" K 
V 
L 
E 
T 

(a) 

1st Column of Fig. 
"deciphered." with 

0 k =■ A. 

Note : In each column 

of the diagram the 
odd letters are the 
cipher letters in the 
corresponding column 
of Fig, 14c.; the even- 
letters in the column 
are decipherments of 
the odd letters, by 
the keyletter shown ' • ; 
at the bottom of the 
diagram, (See Par, 
31a.) 
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U ... 



3 4 5 6 7 8 9 10 11 12 13 
C W.J V-M P S. G X. C L 



(b) 



1st Coluian of Fig. 14(c) 
"deciphered" with initial 
0 k = B. 
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23456789 10 11 12 13 
M C W J V M P S G X C L 
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V 
J 
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.(c) 

1st Column' of Fig. 14(c) "deciphered" 
with® = C. 



Figure 15 
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b_ Inspection of the results of these three trials soon shows that 
the entire series of 26 trials need not be made,, for the results can be obtain' 
ed from the very first trial. This may be shown graphically by superimposing 
merely the results of the first three trials horizontally. Thus: 



i 

i 

i 

i 



,\ 



Cipher Letters of Col. 1 - Fig 
Key Letters 



15 - tdpcrgxpw cve 

A - TKFXUMLESKLT 
B - SLEYTNKFRLKU 
C- RMDZSOJGQMJV 




Figure 16. 



c. It will be noted that the vertical sequences in adjacent columns 



proceed in opposite directions, whereas those in alternate columns proceed in 

j 

the same direction. The explanation for this alternation in progression is 

i 

the same as in the previous case wherein this phenomenon was encountered 
tDE C R G'% P W CVE (Par. 29cj2)), and the sequences in .Fig. 16 may 
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now be completed very quickly. The diagram be- 
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comes as shown in Fig. 17. 
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trices of Fig. 17 is the correct one; that is, it 
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contains the actual plain-text equivalents of 


J 


U V 


H 


K 


w 


B 


0 


I U 


B 


D 




I 


V U 


I 


J 


X 


A 


P 


H V 


A 


E 


the 1st, 14th, 27th, ... letters of the message. 
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.The correct generatrix can be. selected by mere 
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ocular examination, as is here possible (see . 
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generatrix marked by asterisk in Fig. 17), or it 
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may be selected by a frequency test, assigning 
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plain-text frequency. (See Par. 14f of Military 
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Cryptanalysis, Part II.) 



Figure 17 
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e_. Identical procedure is followed with respect to column 2, 3, 4, ... 
of Fig. 14c_, with the result that the initial keyword HORSECHESTNUT is recon- 
structed and the whole message may be now deciphered quite readily. 

32. Conversion of foregoing aperiodic cipher into periodic form. - a. 

In Par. 30_e_ it was stated that an aperiodic cipher- o'f the .foregoing type may 

; - ‘ - Cl • 

be reduced to periodic, terras and. solved as. though it were a repeating-key 

cipher, provided the primary components are known sequences. The basis of 

the method lies in the phenomena noted in Par. 29. 'An- example will be given. 

b. Let the cipher:. text of tho: message ' of Par. 30b_-.be set down again, 

as in Fig. 14o: ‘ ' ’ >/ 

1 2 3 4 5 6 7 8 9 10 11 12-13 
TMCW.JVMPS G X CL'' 1 
DCNINONYG U 0 I N 

' P E T X Q G T .R X - F- J I'M 

CEEXUJTWD Y X A Z 

81 G V A K X K F 0 D W N ' - ' 

GLDFBHPFW Q, Z R H 

X S K Fl'.M I A J C F G K- - 

P Y X I Y M P E X E 0 P Q, 

' W W R V C W J S E W F Z M ■- . 

CLOPIUGWA X VI U G 

VMF-YXJXV/Z F VJ E V - - ■ •.< • 

EURZRHHGU T Q, B G 

Using direct standard alphabets (Vigenere method ) , "decipher" the second line 

by means of the first line, that is, taking the letters of the second line 

as cipher text, those of the first line as keyletters. Then use the thus- 

found "plain text" as "key letters" and "decipher" the third line of Fig 14e_, 

as shown in Fig. 18. Thus: : - 

"Key" THCSJ' V MPSGXCL . 

• Cipher... . D C N- I N 0 -N Y : G U 0 I N ' ' : 

'Plain" . . . KQLMETZJ00RGC 

"Key" KQLHETZJ00RGC 

Cipher..'.. P E T X Q'G T R XI JIM".: . 'I 

'Plain". . . ..FOILMNUI JRSCI 

Figure 18. 
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Continue this operation for all the remaining lines of Fig. 14c_ and write 

down the results in lines of 26; letters. Thus: 

T M C. W J VMPSGXC LIQLHETZ JO OHC 
FO ILMN.UI JRSCKXQIiJ IIJZOUHFYP 
U U K_J S qYULHYYYMRAH JHRJLJBTJ 
L B K_J EVRRYTENB EXNZDRYAZLKCP 
S Z. E W I F L S F L V X X K M K T A ? V E V M B X J 
• ,;L AVFXUCSETVHMTU.WUUNFOqAVUU 

Figure 19. 

Now write down the real plain .text of the message in lines of 26 letters. Thu 

MY LEF TF LANKISRE.C E IYINGHEAV 
YART'I LLERYFIEEENEMYISMAS S I 
N G T_R OOPSTOLEFTFRONTANDCONC 
E N TJR ATINGART I LLIHYYHEREXII 
LLNEEDCONSIDEEABLEEEINFORC 
EHENTSTOMAINT AINMY POSITION 

Figure 20. 

£. When the underlined repetitions in Figs. 19 and 20 are compared, 

they are found to be identical in the respective columns, and if the columns 

of Fig. 19 are tested, they will be found to be monoalphabetic. The cipher 

'message now gives every indication of 'being a repeuting-key cipher. It is 

not difficult to explain this phenomenon in the light of the demonstration 

given in Par. 29g_, First, let the keyword HORSECHESTNUT be enciphered by 

the following alphabet: l 

A B C D E F G H I J K L M N 0 P Q R S T U V Vf X Y Z 

A Z Y X W V U T S R Q, P 0 N M L K J I H G F E D C B 

"Fla in" HORSECHESTNUT 

"Cipher" ... T M J I U Y T W IHNGH 

Then let the message' MY LEFT FLANK; etc,. , be enciphered by direct standard 

alphabets as before, but for the key add the monoalphabetic equivalents of 

HORSECHESTNUT ( TM JIW . . . ) to the key itself, that is, use the 26-letter key 

HORSECHESTNUTTllJnVYTVJIHNGH in a repeating-key manner. Thus (in Fig. 21): 
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Key H 0 R S E C H E S T' N U T T M J I W Y T W I H N G H 

Plain M Y L E F T F L A N K I , S R E C E. I V I N G H E A V . 

Cipher. . . T M C W J V M P S G X C ' L K Q, L M E T Z J 0 0 R G C 

Plain YARTILLERYFI-REENE MY I S M A S S I 

Cipher. . . FOILMNUIJ R.S Cl X Q, VI M I W Z 0 U H F Y P 

Plain. ... N G T R 0 0 P S .T 0 L -E,F-T F R ,0 N- T A N D C 0 N C 

Cipher. . . U U K J S Q, Y IJ L H YYY M R'A WJRRJLJBTJ 

Plain' E N T R A T INGARTILL’ERYTHEREXWI 

Cipher. ... LBKJ.EV R. R Y T E N B E, X N : ZURY.AZLKCP 

.Plain;.... L.LN. EEDCONSI D E R_ A BLEEEINF.ORC 
Cipher. . . S Z E W I F L S F L V X X K M K T A P V E V M B X J 

Plain E M E N T S T 0 M A I N T A I IT M Y P 0 S I T ION 

. Cipher.... - L A..V F X U C S E T V H,M T U.W U U II F 0 Q A V U U 

Fiture .21. . 

The cipher resultants of this process of enciphering . a message coincide exact- 
ly with those obtained from the ’’ deciphering ” operation that gave rise to 
Fig. 19. How does this happen? 

d_. First, let it be noted that the sequence TMJI ... , which forms the 
second half of the key for enciphering .the text in Fig. 21 may be described 
as’ the standard alphabet complement of the. sequence HORSEGHESTNUT, which form: 
the first half of that key. Arithmetically, the sum- of a letter of the first 
half and its .homologous letter in the second half is .26. Thus: 

'i 

■Vv ,..H+T: 7 + 19 = .26 = 0 - . ... . . • 

0 fix =14 12 a 26 = 0 

R+ J =17 + 9 = 26 = 0 

S-+- I =18 t 8 = 26 = 0 

E ■+•-.¥ = 4 -t- 22 = 26 = 0 

That is, every letter of HORSEGHESTNUT plus, its homologous .letter, of. the 
sequence TMJrt'fYPFIHNGH equals 26, which ..is here the same as zero. In other 
words, the sequence. TMJP'rYTT^IHNGH-.is, by cryptographic arithmetic, equivalent 
to "minus: HORSECHESTMJT.” ■ Therefore, in Fig. 21, enciphering the second half 
of each line by the keyletters TMJIVIYWIHIJGH ; ( i.e. , adding .19,. .12, 9, 8,.,...) 
is the same as deciphering by the keyletters HORSECHESTNUT (i.e., subtracting 
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7, 14, 17, 18, . ..). For example: . ■■■'' 

• Rp (T k ) - 17 + 19 = 36 = 10 a K, and 
•R p (-H k ) i 17 - 7s 10 - K 
E p (M k ) - 4 4- 12 = 16 = %, -and ■ 

Ep (-O k ) = 4 - 14 = (26 4- 4) - 14 ; 16 ■ Q^, and so on. 
e_. . Refer now to Fig. 19. The letters in the first half of line 1, 
beginning TMCWJ ... are identical with those in the first half .of line 1 of 
Fig. 21. They must be identical because they are produced from identical 
elements. The letters in the second half of this same line in Fig. 19, 
beginning KQ1ME ... were produced by - dec iphering the letters in the second 
line of Fig. 14_c. Thus (taking for illustrative purposes only the first 
five letters in each case); . : * 

K Q, L M E s D C N I N - T M C W J- ■. . ; 

• • ’ But D C N I N = R E C E I 4 - M Y L E F 

And ' TMCWJ = M Y L E F + H 0 R S E ; 

Hence, : r K Q, L M E = (R E C E I f M.YLE F) - (M Y.L E F. + H0ESE) 
Or, KQLME = RECEI - HORSE (1) 

As for the letters in the second half of line 1 of Fig. 21-, also beginning 
KQLME ... , these letters were the result of enciphering RECEI by TMJIW. 

Thus : . 

. K Q L M E = R E C E I 4 - T M J I W 
But it has been shown in subpar. d_ above that ' ■ 

TM JIWr-HORSE 

Hence, K Q L M E s R E C E I +• (-H ORSE) 

Or, ' K Q L M E = ; R E C E I - II 0 ! R S E (2) • 

Thus, equations (1) and (2) turn out to be identical but from what appear to 
be quite diverse sources. 
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f. What has been demonstrated in connection with the letters in. line 1 
of Figs,. 19 and 21 holds true for the letters in the other linos of these 
two figures, and it is not necessary to repeat the explanation. The steps 
show that the originally aperiodic,- auto-key 1 cipher has been converted, throu 
a knowledge of the primary components, into a repeating-key cipher with a 
period twice the length of the introductory key. The message may no w be 
solved as an ordinary repeating-key cipher. • 

j*. (1) The foregoing case is based upon encipherment by the encipher- 

ing equations $ k / c -0 ^/p ; 0 p /p =$c/c* When encipherment by. the encipher- 
ing equations 0 k / c . = 9 ^/^ ; ®p/ c = 0 c /p has been followed, the conversion of 
a plain-text auto-keyed cipher yields a repeating-key cipher with a period 
equal to the length of the introductory key. In this conversion, the encipher- 
ing equations ^/c = ^i/p > ®p/p '= ®c/c are use ^ finding equivalents. 

(2) An example may bo useful. Note the encipherment of the follow- 
ing message by auto-key method by enciphering equations G^/c = 0i/p>0p/ c =0 C . 

T U E SD A Y| INFO R 11 A T I 0 N F R 0 M RE LIABLES OURCES IND I ' 
INFORM A'f 1.0 N.FROMRELI ABL.ESOURC ES IND IC ATESTH 
P T B W 0 M C LT JZOFOTjqYD JNZT0DMR-BT0 qZ JR A • W B W F Q Z 

(3) If the message is written out in lines corresponding to the 
length of the introductory key, and each line is enc iphered by the one direct- 
ly above it, using" the enciphering equations 0 k / c - 0jy p P0p/p = 0 C / C in 
finding equivalents, the results are as shown in- Fig. 22b. But if the same 
message is enc iphered by equations 0^/ c = $i/p » ^p/c = ^c/p» us i n g the word 
TUESDAY as a repeating key, the cipher text (Fig. 22_c)- is identical with that 
obtained in Fig. 22b. by enciphering each successive line with the line' above 

• .it. . . ■■ ■ 
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Original cipher text 
and converted text 
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Figure 


22. 






;> 


(4) Now 


note 


that 


the sequences 


joined by 


arrows in Fig. 



are identical and .since it is certain that Fig, 22c^ is periodic in form because 
it was enciphered by the repeating-key method, it. follows that Fig, .22b is 
now also in periodic form, and in that form the message could be solved as 
though it were a repeating-key cipher, . 

h_ . (1) In case of primary components consisting of a direct normal 
sequence sliding against a reversed normal (U. S. Army disk), the process of 
converting the auto-key text to periodic terms is accomplished by using two 
direct normal sequences and "deciphering" each line .of the text (as trans- 
cribed in periods) by the line above it. For . example, here is a message 
auto-enciphered by the aforementioned disk, with the. initial keyword TUESDAY: 

TUESDAY) INFORMATION FRO MRELIABLESOURCESINDI 

INFORMATION FRO MRELIABLESOURCESINDICATESTH 

LHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJAEZEVKB 
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( (2) The cipher text is transcribed in periods equal to the length 

of the initial keyword (7 letters) and the 2d line is "deciphered" with key- 
letters of the 1st line, using enciphering equations 0 ^j Q s & ^ • 0 p /p = 0 C / C 
The resultant letters are then used as keyletters to ’’decipher" the 3d line of 
text and so on. The results are as seen in Fig. 23b. Nov; let the original 
message be enciphered in repeating-key manner by the disk, with the keyword 
TUESDAY, and the result is Fig, 23c_. Note that the odd or alternate lines of 
Figs. 23b_ and c_ are identical, showing that the auto-key text has been convert 



ed into repeating-key text. 
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Original cipher text 
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■ a. b_ c_ 

Figure 23. 

i_. The foregoing procedures indicate a simple method of solving ciphers 
of the foregoing types, when the primary components or the secondary cipher 
alphabets are known. It consists in assuming introductory keys of various 
lengths, converting the cipher text into repeating-key form, and then examin- 
ing the resulting diagrams for repetitions. When a correct key length is 
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assumed, repetitions will be as numerous as should be expected in ciphers of 
the repeating-key class; incorrect assumptions for key length will not show 
so many repetitions. 

j_. All the foregoing presupposes a knowledge of the cipher alphabets 
involved. When these are unknown, recourse must be had to first principles 
and the messages must be solved purely upon the basis of probable words, and 
repetitions, as outlined in Pars. 27-28. 

38. Concluding remarks on auto-key systems. - a, Both cipher- text and 
plain-text auto-keying as cryptographic methods have, as shown, serious weak- 
nesses which exclude them from practical usage in military cryptography. 

Besides being comparatively slow and, subject to error, they are rather easily 
solvable ,- even when unknown c inker alphabets- are emnloyed. 

b. In both systems there are characteristics which permit of identify- 
ing a cryptogram as belonging to ; this class of substitution. . Both cases v/ill 
show many repetitions in the cipher text, but in cipher- text auto-keying there 
will be fewer repetitions than in the original plain text, whereas in plain- 
text auto-keying there will be as -many repetitions in the cipher text as in 
the original plain text. In both cases, repetitions in the cipher text are 
shorter than the equivalent repetitions in, the plain text, the difference cor- 
responding to the number of letters in the introductory key. These repetitions 
will show no constancy as regards intervals between them, and a uniliteral 
frequency distribution will show such messages to be polyalphabetic in nature. 
Cipher-text auto-keying may be distinguished from plain-text auto-keying by the 
appearance of the frequency distribution of the second member of sets of two 
letters separated by the length of the introductory key (see Par. 25h). In 
the case of cipher-text auto-keying these frequency distributions will be mono- 
alphabetic in nature; in plain-text auto-keying such frequency distributions 
will not show monoalphabet ic characteristics. 
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• SECTION DC 

METHODS OF LENGTHENING OR EXTENDING THE KEY.. 

Paragraph 



Preliminary remarks . ... 34 

Extended and nonrepeating keys; the so-called "running-key 

system” 35 

Other systems employing lengthy keying sequences ............. 36 



34. Preliminary remarks. - In Par. lb_ of this text it was stated that 
two procedures suggest themselves for eliminating the weaknesses introduced 
by periodicity of the type produced by simple, repeating-key methods. . The 
first of these, when studied, embraced some of the very simple methods of ' > 
suppressing or destroying periodicity, by such devices as interrupting, the 
key and using variable length groupings of plain text. "It was demonstrated 
that subterfuges of this simple nature are inadequate to eliminate the weak- 
nesses referred to, and must be discarded in any system intended to afford 
real security. The other alternative suggested in Par. lb_ therefore remains 
now to be investigated, viz, that of lengthening the keys to a point' where 
there would seem to be an insufficient amount of text to enable the cryptana- 
lyst to solve the traffic. Attempts toward this end usually consist in extend- 
ing the key to such a length that the enemy cryptanalysts will have only a 
very limited number of periods to work with. The key may, indeed, be lengthen 
ed to a point where it becomes as long as, or longer than, the text' to be 
enciphered, so that the key is used only once. 

35. Extended and nonrepeating keys. - a_. It is obvious that' one of the 
simplest methods of lengthening the key to a message is to use a long phrase 

* • - • • 1 . 4 O. 

or even a complete sentence, provided it is not too long to remember. In 
addition to the difficulties that would be encountered in practical military 
cryptography in selecting long mnemonic phrases and sentences which would, 
have to be imparted to many clerks, there is the fact that the probable-word 
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method of solution still remains as a powerful tool in the hands of enen$r 
cryptanalysts. And' if only a word or- two of the key can be reconstructed as 
a result of a fortunate assumption, it is obvious that the enemy cryptanalysts 
could readily guess the entire key from a fragment thereof, since any long 
phrase or sentence wrhich is selected because it Yean easily be remembered is 
likely to be well known to many people. 

,_b. There are, however, more or less simple methods of employing a short 
mnemonic key. in order to produce a much longer key. Basically, any method of 
transposition applied to a single alphabetic sequence repeated several times 
will yield a fairly long key, which, moreover, has the advantage of being 
unintelligible and thus approaching a random selection of letters. For example 
a numerical key may be derived from a word or a short phrase; this numerical 
key, may then be applied as a columnar-transposition key for a rectangle within 
which the normal alphabet has been repeated a previously agreed upon number 
of times in a normal (left to right) or prearranged manner. The letters when 
transcribed from the transposition rectangle then become the successive letters 
for enciphering the plain text, using any desired type of primary components. 
Or, if a single transposition is not thought to be sufficiently secure, a 
double transposition will yield a still more mixed up sequence of key letters. 
Other types of transposition may be employed for the purpose, including 
various kinds of geometric figures.. Also, a non-transposition method of 
lengthening the keying sequence 'and at the same time introducing an irregula- 
rity, such as aperiodic interruption has already been described (see Par. 18), 
c_. Another method of developing a long key from a short mnemonic- one 
is' ; Juhat, shown below. Given the keyword . CHRISTMAS, a numerical sequence is 
first derived and then one writes down successive sections of this numerical 
key, , these sections terminating with the successive numbers 1, 2, 3, ... of 
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the numerical key. Thus: 



Mnemonic key ... CHRISTMAS 
Numerical key... 2-3-6-4-7-9-5-1-8 



3 


4 


5 


6 


C H 


C H R I 


C H R I S T M 


C H R 



(\ O ? I 

CHRISICHRISTMASICHRISTI 
Thus the original key of only 9 letters is expanded to one of 45 letters 
(1+ 2 -+ 3H...+9 = 45). The longer key is also an interrupted key of the 
type noted under Par. 17, but if the message is long enough to require several 
repetitions of the expanded key the encipherment becomes periodic and can be 
handled by the usual methods employed in solving repeating-key ciphers. If 
the basic key is fairly long, so that the expanded key becomes a quite lengthy 
sequence, then the message or messages may be handled in the manner explained 
in Par. 20. 

36. Other systems employing lengthy keying sequences. - a.. The so -ca llec 
"running-key” system . To be mentioned in connection with this subject of 
extensive or lengthy keys is the cipher system known as the running-key, 
continuous-key, or nonrepeating-key system, in which the plain text of a 
previously-agreed-upon book serves as the source for successive keyletters 
for encipherment.'*' The solution of this type of cipher, an accomplishment 
which was once thought impossible, presents some interesting phases and will 
be considered shortly. At this point it is merely desired to indicate that 
according to the. running-key system the key for an individual message may be 
as long as the message and never repeat; but if a large group of communicants 
employ the same book, it may happen that there will be several messages in 
the same key and .they will all begin with the same initial keyletter; or, 




REF ID:A4146453 

N 

. . - 92 - 

there will be several which will "overlap" one another with respect to the 
key, that is, they will begin with different initial keyletters but soon will 
fall under the same sequence of keyletters, , 

b. The so-called "progressive-alphabet" system . In the so-called 
progressive-alphabet system the basic principle is quite simple. Two or more 
primary elements are arranged or provided for according to a key which may 
be varied from time to time; the interaction of the primary elements results 
in making available for cryptographic purposes a- set of cipher alphabets; all 
the latter are employed in a fixed sequence or progression; hence the designa- 
tion progressive-alphabet system. If the number of alphabets available for 
such uso is rather small, and if the text to be enciphered is much longer 
than the sequence of alphabets, then the system reduces to a periodic method. 
But if the number of alphabets is large, so that the sequence is hot repeated, 
then of course, the cryptographic text will exhibit no periodic phenomena, 

c_. The series, of cipher alphabets in such a system' constitutes a key- 
ing sequence. Once set up, often the only remaining element in the key for 
a specific message is the starting point in the sequence, that is, the initial 
cipher alphabet employed in enciphering a given message. If this keying 
sequence must be employed by a large group of communicants, 'and if all message 
employ the same starting point in the keying sequence, obviously the crypto- 
grams may simply be superimposed without any preliminary testing to ascertain 
proper points for superimposition. The student has already been shown how 
cases of this sort may be solved. However, if messages are enciphered with 

• • ’ * 1 ’ • ’ ,* . ; ■ i 

varying starting points, the matter of superimposing them properly takes on 
a different aspect. This will soon be treated in detail. 

_d. In addition to the foregoing, there are, of course, a great many 
mechanical methods of producing a long key, such as those employed in mechani- 
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cal or electrical cipher machines. In most cases these, methods depend upon 

the interaction of two or more short, primary keys which jointly produce a 

single, much longer, secondary or resultant lcey. (See Par. 4). Only brief 

reference can be made at, this point in the cryptanalytic studies to cases of 

this kind. A detailed treatment of complex examples would require much time 

and space so that it will be reserved for subsequent texts. 

. _e. Finally, there must be mentioned .certain devices in which, as in 

encipherment' by the auto-key method, the text itself serves to produce the 

variation in. cipher, equivalents, by controlling the selection, of secondary 

alphabets, or by influencing or determining the sequence with which they 

will be employed. Naturally, in such. cases the key is .automatically extended 

to a point where it coincides in length with that of the text. An excellent 

2 

example of such a device is. that, known as the Wheatstone- , ' the solution of 
which will be described in its proper place. 




2 See Sect. XII, 
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SECTION X 

GENERAL PRINCIPLES UNDERLYING SOLUTION OF SYSTEMS 
EMPLOYING LONG OR CONTINUOUS KEYS. : 

Paragraph • 



Solution when the_ primary components are known sequences 37 

Solution of a running-key cipher when the primary components . 

are known ' : 38 

Solution of a progressive-alphabet’ cipher when the primary 

components are known 39 

General solution for ciphers involving- a long keying 

sequence of fixed length and composition 40 



37. ' Solution when the primary components are known sequences. - a.. As 

usual, the solution of' cases’ involving long or continuous- keys will -be treated 
under two headings: first, when the primary components are known sequences; 

second," when these olements are wholly unknown or partially unknown.' 

b." Since the essential purpose in 'using' long keys 'is to prevent the : 

formation of 'repetitive cycles within the text, it is obvious that in the case 

of very long keying sequences the cryptanalyst is not going to be able to • take 

the text and break it up into a / number of small cycles which will permit the 

establishment of monoalphabet ic frequency distributions that can readily be 

knows 'the' primary sequences e 
' solved, an end Which he can attain -all the more readily if to begin with he / 

But, there nearly always remains the cryptanalyst’s last resort: the probable- 

word method. Inasmuch as this method is applicable to most of these cases, 
even to that of the running-key system, which perhaps represents the furthest 
extension of the principle of long keying sequences, an example using a cryp- 
togram of the latter type will be studied. 

38. Solution of a running-key cipher when the primary components are 
known. - a. In Par. 35c_ mention was made of the so-called running-key, 
continuous -key, or nonrepeating-key system, in which the plain text of a 
previously-agreed-upon book serves as the source for successive key letters for 
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encipherment. Since the running-key system is entirely aperiodic, and the 
cipher text can therefore not be arranged in superimposed short cycles, as in 
the case of the repeating-key system, it would appear on first consideration 
to be "indecipherable" without the key.'*' .But if the student will bear in mind 

that one of the practical methods of solving a repeating-key cipher is that 

o ' * • . / 

of the probable word*", he will immediately see that the latter method can also 
be applied in solving the nonrepeating-key system. The essence of the matter 
is this: the cryptanalyst may assume the presence of a probable word in the 

text of the message; if he knows the primary components involved, and if the 
assumed word actually .exists in the message, he can locate it by checking 
against the key, - since the latter is intelligible text . Or, he may assume the 
presence of a probable word or even of a phrase such as "to the", "of the", 
etc., in the key text and check his. assumption against the text of the message, 
Once he has forced such an entering wedge into either the message .or- the key-, . 
he may build upon this foundation by extending his assumptions for text alter- 
nately in the key and in the message, thus gradually reconstructing both. For 
example, given a -cryptogram containing the sequence ... HTCGLOWBESLTR ..., 
suppose he assumes the presence of the phrase THAT THE in the key text and 
finds a place in the* plain' text where this yields MMUNITI. Thus, using 
reversed standard cipher alphabets: 



At one time, indeed, this view was current among certain cryptographers,' who 
thought that the principle, of factoring the intervals between repetitions in 
the case of the repeating-key cipher formed the basis for the only possible 
method of solving the latter type of, system.. Since, according to this erroneous 
idea, factoring cannot be applied in the case of the running-key system (using 
a book as the. key), therefore no solution is possible. . How far this idea is 
from the truth will presently be seen. 



2 



See Military 




Part II, Par, 



25 . 
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Assumed key text . . THATTHE ... 

Cipher text ...H? G GL 01 B IS L T R ... 

.Resultant .plain text MMDN I T I ... 

This suggests the .word. AMMUNITION. The ON in the cipher text then yields PR 
as the beginning of the word after THE in the key text. Thus: 

Assumed key text' ....... ...THATTHE? R ... 

Cipher text ...H V\G G L 0 W BE S' L T R ... •' 

Resultant plain text ... ...M MUNITION... 

PR must be. followed by a vowel, with 0 the most likely candidate. He finds 
that 0 yields W in the plain text, which suggests the word WILL. The latter 
then yields OTEC in the key, making the latter read THAT THE PROTEC... • Thus ■ 

Assumed key text ...THATTHEPROTEC.., 

Cipher text " . ..HVGG L O W S E S L T R ■' 

. Resultant plain text ... . . .MM UNITIONWILL... 

This suggests the word PROTECTION, PROTECTIVE, PROTECTING, etc. Thus extending 
one text . a. few letters serves to "coerce" a few more letters out of the other, 
somewhat as in. the case of two boys who are funning approximately abreast in 
a race; as soon as, one boy gets a bit ahead the spirit of competition causes 
the other to overtake and pass the first one; then the latter puts forth a 
little more effort, overtakes, and passes the second boy. Thus the boys alter- 
nate in overtaking and passing each other until the race is rim. The only 
point in which, tho simile. fails is that while the boys usually run forward 
all the time, that is, in a single direction, the cryptanalyst is free, to work 
in two directions — forward and backward from an internal point in the message 
He may, in the case of the example cited above, continue his building up 
process by adding A to the front of MMUNITI as well as ON to the rear.- If he 
reaches the end of his resources on one end, there remains the other end for 
experimentation.' He. is certainly unlucky if both ends terminate in. complete '• 
words both for '.the .message' and' for the key, leaving him without a- single clue 
to the next word' in either, and forcihg. him to a more intensive use of his 
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imagination, guided only by the context, 

b_. ' In the foregoing illustratidn the cryptanalyst- is- assumed, to'-have 
only one message available for Ills experimentation-. But if he has two or 
more messages which either' begin at identical initial points with reference 
to the key, or overlap one another with respect to the key, the reconstruction 
process described above is, of course, much easier and is accomplished much, 
more quickly. - For if the messages have been correctly superimposed with 
reference to -the, key text, the addition of one or two letters-, to .the key yie lds 
suggestions for the assumption of words in several -messages . The latter lead 
to the addition of several letters to the key, and so on, in an ever-widening- 
circle of ideas for further assumptions, since as the process continues the 
context affords more, and more of a basis for the work. • ; ■ 

c_. Of course, if sufficient of the key text is reconstructed, the 
cryptanalyst might identify the book that is being used for the key, and if 
available, his subsequent labors are very much simplified. 

d_. All the foregoing is, however, dependent upon having a knowledge of 
the primary components or cipher alphabets employed' in the encipherment. Even 
if the primary components are differently -mixed sequences, so long as they are 
known sequences, the procedure is quite obvious - in view of the foregoing expla- 
nation. The training the student has already had is believed sufficient to 
indicate to him the procedure he may follow in that solution, and no further 
details will here be given in respect to such cases. -But what if the primary 
components are not known sequences? This contingency will be -treated presently. 

39. Solution of a progressive-alphabet cipher when the cipher alphabets 
are known. - a. ' Taking a very simple case, suppose' the interacting elements 
referred to in Par. 36b_ consist merely of two primary cipher components which 
slide against each other to produce a set of 26 secondary cipher alphabets. 
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Beginning at an initial juxtaposition, producing say, alphabet 1, the subse- 
quent, secondary alphabets, are in .the sequence 2, 3, ... 26, 1, 2, 3 ... , 
and so on,. If a different initial juxtaposition is vised, say alphabet 10 
is the .first one, the -sequence, is exactly the same as before, only beginning 
at a different point. 

.. b. Suppose the two primary components, are ..based upon the keyword 

HYDRAULIC. A message is to be enciphered, beginning with alphabet 1. Thus: 

Plain component. . .- H-Y DRAULICBE F,G, JKM.N0.P Q S ,T V W X Z H Y D. . 
Cipher component. . H Y D R 'A U L I CBE JL M N'O P Q, S T V-WX-Z 

Letter No... 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15-16 ' 17 18 19 20 21 22 23 24- 

Alphabet ... 1 2 3 4 5.6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 

Plain' text . ENEMYHAS.P.L A fl E D H E A V Y INTER 

Cipher text. E 0 G P U U E Y H M K Q, V M : K,.Z S J .Q H E N L H ' 

Letter No... 25 26 27 28 -29 30 31 32 33 34 35 36 37 .38 39 40 41 42 43 44 

Alphabet ... 25 26 1 234 5 6 7 8 9 10 11 12 13 14 15 16 17 18 

Plain text . D I C T 10 N F I R E, U P 0 N Z A N E S 

Cipher text. H L C V B S S N J EP K D D D GP U H F 

Letter No/.. 45 46 47 48 49 50 51 52 53 

Alphabet ... 19 20 21 22 ; 23 2.4, 25 26 1 . 

Plain text . V I L L E R OAD 

Cipher text. K H H Y L . H . K R D 

■ c_. This method reduces to. a periodic system involving 26 secondary 

‘ s f 

cipher .alphabets and the latter are used in simple progression. .It- is obvior : 
therefore that the 1st, 27th, 53d, ... letters are in the 1st alphabet; the 
2d, ..28th, -54th, ... letters are, in the 2d alphabet, and so on. 

... d« To solve such a, cryptogram, knowing the .two primary components , is - 
hardly a problem : at all. The only -element lacking is a knowledge of the start- 
ing point. But this is not. necessary, for merely by completing the plain- 
component sequences and .examining the diagonals of the diagram, the plain 
text becomes evident. . For. example, . given the following: HIDCT EHUXI. 
Completing the plain-component sequences initiated by the successive cipher 
letters, the plaintext, ENEMY MACH I... is seen to come out in 
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successive steps upward in Fig. 24. Had the cipher 
component been shifted in the opposite direction in 
encipherment, the steps would have been downward 
instead of upward.; If the sliding strips are set 

A 

up according to the sequence of cipher letters but 
on a diagonal, then of course, the plain-text 
letters, would- have reappeared, on one generatrix. 

e_. The student will understand, what simple Figure 24. 

modifications in procedure. would be required in case the two primary compo- 
nents were different mixed sequences. But what if the primary components 
are not known -sequences? How does the cryptanalyst proceed in that case? 

40. General solution. for c iphers involving a long. keying sequence of 
fixed length and composition, - a. It is obvious, as stated at a previous 
point, that no matter how the keying sequence is derived, if all the communi- 
cants employ the same key, or. if this key is used many times by a single 
office, and if it always begins at the same point, the various messages may 
simply be superimposed . Thus, their respective 1st, 2d, 3rd, ,. . letters will 
all fall within columns which have been enciphered by the 1st, 2d, 3rd, ... 
key letters. If there is a sufficient number of messages, solution then . 
becomes possible by frequency analysis of the successive columns — no matter 
how long the keying sequence may be. This method of solution by superimposi- 
tion has already been outlined in. Par. 20 and no further reference ..to it need 

V, ‘ 

here be made. 

b_. But now suppose that the keying sequence does not always begin at, 
the same point for all messages. Suppose the several communicants are able 
to select at will any element of the keying sequence and employ it as the 
initial key letter. Thus, such a keying sequence, if regarded as partaking of 



HIDCTEHUXL 
YCRBVFYLZI 
D B. A E W G D,.I H C 
REUFXJRCYB 
AFLGZKA. BDE 
UGIJHM'U'ERF 
L J CKYNLFAG 
IKBMDOIGUJ 
CMENHPG JLK 
B N F 0 A Q, B K I M 
E 0 G P U S E. M C N 
FP J QLTFNBO 
G Q KS I.V GO.EP 
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the nature, of a circle, will afford as many possible starting points as there 
are letters or characters in that sequence. Now if there are no external indi- 
cations or indicators in the cryptograms pertaining to such a system, such as 
would afford enemy cryptanalysts direct and definite information with regard 
to the initial keying element for each cryptogram, then it would seem as though 
the super imposition of messages (to bring letters enciphered by the same cipher 
alphabets within' the same columns) would be difficult or impossible, and there- 
fore that attempts at solution are blocked at their very beginning. This, 
however, is' not the end of' the story,' For suppose two of the messages have 
in common only one polygraph; say of 5 letters; these two messages may be 
juxtaposed so as to bring these repetitions into superimposition. Thus, the 
possession Of this long polygraph in common serves to ’’tie” these two messages 
together or to "interlock" them. Then, suppose' a shorter polygraph, say of ;: 

4 letters, is possessed in common by one of these two messages and a third 
message; this will serve to tie in the ’latter with, the first .two. Extension 
of this process,- including the data from shorter repetitions of trigraphs and 
digraphs, will serve to assemble a whole set of such- messages in proper super- 
imposition. Therefore, the first step is to examine all the messages for' 
repetitions. " / •, 

c. When such repetitions are found, and if there are plenty of them so 
that assumptions for probable words are easy to make, it is' clear that the 
correct assumptions will enable the cryptanalyst to set up plain-cipher equi- 
valencies which will make it possible to reconstruct the primary components. 
Depending upon the type used, the principles of direct or- indirect symmetry 
of position will be' very useful in this process. 

■d* But if it happens that there are no polygraphs by means of which two 
or more messages may be tied together and properly superimposed, the simple 
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methods mentioned in subparagraphs a-c_ cannot here be applied. However, 
although the road toward a solution seems to be blocked rather effectively, 
there is a' detour which presents rather interesting vistas. The latter are 
really of such importance in cryptanalysis as to warrant detailed treatment. 



SECTION XI 

THE CEYPTANALYTIC COINCIDENCE TEST. 



Paragraph 

The basic theory of the coincidence test 41 

General procedure to be followed in making the ^ -test 42 

Example of application of the -test 43 

Subsequent steps ■ 44 

41. The basic theory of the coincidence or K -test. - a. In Appendix 2 



of the preceding text' 1 ' certain simple applications of the theory of probabili- 
ty were presented for the student’s consideration, by way of pointing out to 
him' the important role which certain phases of that branch of mathematics 
play in cryptanalysis. Reference was there made to the subject of coinc idences 
and the bearing it has in connection with the study of repetitions in crypto- 
grams. In this section the matter will be pursued a few steps further. 

_b. In the appendix referred to, it was shown that the probability of 

monographic coincidence (1) in random text employing a 26-letter alphabet is 

/ ' 

.0385; (2) in English telegraphic plain text, .0667. These two parameters 
were represented by the symbols K r and 'ftp, respectively. The important role 
which these values play in a certain eryptanalytic test will now be explained. 

c_. One of the most important techniques in cryptanalytics is that known 
as applying the coincidence or "kappa” test. This test is useful for several 



^Military Cryptanalysis, Part II. It is recommended that the student refresh 
his memory by reviewing this appendix,. 
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cryptanalytic purposes and one of the most important of them is to ascertain 
when two or more sequences of letters are correctly superimposed. By the' 
word "correct” in this case is merely meant that the sequences are so arranged 
relatively as to facilitate or make possible a solution. The test has for 
its theoretical basis the following circumstances: 

(1) If any two rather lengthy sequences of characters are super- 
imposed, it wll be found, .on examining both. members of the successive pairs 
of letters- brought into vertical juxtaposition, that in a certain number of 
cases the two superimposed letters will coincide . > 

(2) If. both, sequences of letters constitute random text (of a 26- 
letter alphabet), there will be' about 38 or 39 such cases of coincidence per 
thousand pairs examined. This, of course, is because K r = .0385. 

(3) If both sequences of letters constitute plain text, there will 
be about 66 or 67 such cases of coincidence per thousand pairs examined. This 
is because Kp is .0667. 

(.4) If the superimposed sequences are wholly monoalphabet ic enci- 
pherments of plain text by the same cipher alphabet, there will still be about 
66 or 67 cases of coincidence in each 1000 cases examined, because in mono- 
alphabetic substitution there is a fixed or unvarying relation between plain- 
text letters and cipher letters so that for statistical purposes monoalphabetic 
cipher text behaves just the same as if it were -normal plain text. 

(5) Even if the two superimposed sequences are not monoalphabet i- 
cally enciphered texts, but are polyalphabet ic in character, there will still 
be about 66 or 67 cases of identity between superimposed letters per thousand 
cases examined, provided the- two sequences really belong to the same crypto - 
graphic system and are- superimposed at the, proper point With rospect to the 
keying sequence . The reasons for this-' -will 'be- set forth in the succeeding 
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sub-paragraphs. 

(6) . Consider the two messages below. They r have been enciphered 
polyalphabet ically by the same two primary components sliding against each 

-other. The two messages use the same keying sequence, beginning at the same 
initial point in that sequence. Consequently, the two messages are identi- 
cally enciphered, letter for letter, and the only differences between them 
-are those occasioned by differences in plain text. 

(Alphabets. ..16' 21 13 5 6 4 17 19 2.1 21 2 6 3 6 13 13 1 7.12 6 

. No .1/ Plain text.. W H E N I N T H E C O U R S EL 0 N G. M . . . 

.(Cipher. .. . . . E 0. N B T F Y R C XX L Q, J ‘ N Z 0 Y AW... 

'Alphabets... 16 21 13 5 6 4 17 19 21 21 2 6 3 6 13 13 1 7 12 6 ... 

No. 2 J Plain text.. T H E G E N, E RALABSOLUTELY... 

Cipher P Q N T U F 3 W D J LQ,H Y ZPTMQ, I... 

Note, now, that (a) in every case in which two superimposed cipher letters 

are the same, the plain-text letters are identical and (b) in every case in 

which two superimposed cipher letters are different, the plain-text letters 

are different. In such a system, even though the cipher alphabet changes 

from letter to letter, the number of cases of identity or coincidence in the 

two members of a pair of superimposed cipher letters will still be about 66 

or 67 per thousand cases examined, because the two members of each pair of 

superimposed letters are in the same cipher alphabet and it has been seen in 

(4) that in monoalphabetic cipher text K is the same as for plain text , viz , 

.0667 . The two messages may hero be said to be superimposed "correctly", that 

is, brought into proper juxtaposition with respect to the keying sequence. 

(7) But now suppose the same two messages are superimposed 

: '• > V • 

"incorrectly", that is, they are no longer in proper juxtaposition with res- 



Ca . ; 

The fact that in this caso each monoalphabet contains but two letters docs 
not affect the theoretical value of K ; and whether the actual number of coin- 
cidences agrees closely with the expected number, based upon K = .0667 depends 
upon the lengths of tho two superimposed sequences. 
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pect to tho keying sequence. Thus: 

• . • r | ‘ . ? ) - ‘ , . 

Alphabets... 16 '21 13 5 6 4 17 19 21 '21 2 6 3 6 13 13 1 7 12 ... 

No.l . Plain text... W. H E, N I N THE C 0 U R S E .L 0 IJ G ... 

Cipher....... E Q, N 3 T F Y R ; C X X L Q, J -N Z 0 Y A- . . . 

Alphabets... 16 21 13 5 6 4 17 19 21 21 2 6 3 6 13 13 1 7 ... 

. Plain text.. ,T H E G. E IT. E .R A L A' B S 0 L U T E ... 

Cipher...... P Q, N T U F B "W D' J' L Q, H Y Z P T M ... 



It is evident that the two members of every pair of superimposed letters are 
no longer in the same cipher alphabet, and therefore, if two superimposed 
cipher letters are identical this is merely an "accident*', ... for now there is ; 
no basic or general cause for the similarity, ■ such as is true in the case of 
a correct super imposition. The similarity, if present,, is, as already stated, 
due to chance and the number of such cases of similarity should be about the 
same as though the two cipher letters were drawn at random from random text, 
in which 'K r a . 0385, It is no longer true that (a) in every case in which 
two superimposed cipher letters are the same, the plain-text letters are iden- 
tical, or (b) in every case in which. two superimposed cipher letters are 
different, tho plain- text letters are different. Note, for example, that 
the superimposed T *s represent two different plain-text letters and that the 

of the word COURSE in the 1st message gives J while the S of the word 

P ■ . •. ; . - . , ■ C I 

ABSOLUTELY in the 2d message gives H . Thus, it becomes clear that in an 
incorrect superimposition two different plain-text letters enciphered by two 
different alphabets may "by chance" produce identical cipher letters, which 
on superimposition yield a coincidence having no external indications as to 
dissimilarity in plain-text equivalents. Hence, if there are no other factors 
which enter into the matter and which might operate to distort the results to 
be, expected from the operation' of the basic factor, the expected number of 
cases.. of identical cipher letters brought together by an incorrect superimpo- 
sition will bo determined by /the vnlue K - ,0385. 

’ r 
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(8) But now note also that in the foregoing incorrect superimposi- 
tion there are two Z c 's and that they represent the same plain-text letter L. 
This is occasioned by the fact that the plain-text messages happened to have 
L*s in just those two places and that the cipher alphabet happened to be the 
same both times. Hence, it becomes clear that the same cipher alphabet 
brought into play twice may "by chance" happen to encipher the same plain- 
text letter both times, thus producing identical cipher letters. In some 
systems this source of identity in superimposed cipher letters is of little 
importance, in other systems it may materially affect the actual number of 
coincidences. For instance, if a system is such that it produces a long 
secondary keying cycle composed of repetitions of short primary keying cycles, 
an incorrect superimposition of two cryptograms may bring into juxtaposition 
many of these short cycles, with the result that the actual number of cases 
of identical superimposed cipher letters is much greater than the expected 
number based upon K r = .0385. Thus, this source for the production of iden- 
tical cipher letters in an incorrect superimposition operates to increase the 
number of cases to be expected from the fundamental constant K r a. .0385. 

(9) In some systems, where nonrelated cipher alphabets are employ- 
ed, it may happen that two identical plain-text letters may be enciphered by 
two different cipher alphabets which, "by chance", have the same e qui valent ' 

for the plain-text letter concerned. This is, however, a function of the 

n • 

particular cryptographic system and can be taken into account when the nature 
of the system is known. 

(10) In general, then, it may bo said that in the case of a correct 
superimposition the probability of identity or coincidence in superimposed 
cipher letters is .0667; in the case of an incorrect superimposition, the 
probability is at least .0385 and may be somewhat greater, • depending upon 
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special circumstances. The foregoing situation and facts make possible what 

A 

has been referred to as the "coincidence test," Since this test uses the 
constant K, it is also called the "kappa test." 

d. The way in which the coincidence test may be applied will now be 
explained. The statement that K. = .0667 means that in 1000 cases where two 
letters are drawn at random from a large volume of plain text, there will be 

about 66 or 67 cases in which the two letters coincide, that is, are identical. 

• - > 

Nothing is specified as to what the two letters shall be; they may be two Z’s 
Or they may be two E’s. This constant, ,0667, really denotes a percentage: 
if many comparisons of s ingle letters are made, the letters being drawn at 
random from among those constituting a large volume of plain text, 6.67$ of 
these comparisons made will yield coincidences. So, if 2000 such comparisons 
are made, the theory indicates that there should be about .0667 x 2000 - 133 
coincidences; if there is sufficient text to permit of making 20,000 compari- 
sons, there should be about 1334 coincidences, and so on. 

e. Another way of handling the matter is to find the ratio of the ob- 
served number of coincidences to the total number of cases in which the event 
in question might possibly occur, i.e., the total number of comparisons of 
superimposed letters. When this ratio is closer to ,0667 than it is to .0385 
the correct superimposition has been ascertained. This is true because in 
the case of a correct superimposition both members of each pair of superim- 
posed letters actually belong to the same monoalphabet and therefore the 
probability of their coinciding is .0667; whereas in the case of an incorrect 
superimposition the members of each pair of superimposed letters belong, as a 

v. 

: . . ; ■ 3. . . 

general rule, to different monoalphabots , and therefore the probability of 

3 ‘ • 

The qualifying phrase , "as a general rule" is intended to cover. any distortion 

in results occasioned by the presence of an unusual number of those cases of 
coincidence described under subparagraph c_(8) and (9). 
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their coinciding is nearer .0385 than .0667. 

. . " the . 

f_. From the foregoing, it becomes clear that/kappa-test involves ascer- 
taining the total number of comparisons that can be made in a given case, as 
well as ascertaining the actual number of coincidences in the case under 
consideration. When only two messages are superimposed, this is easy: the 

total number of comparisons that can be made is the same as the number of 
superimposed pairs of letters. But when more "than two messages are superim- 
posed in a superimposition diagram it is necessary to make a simple calcula- 
tion, based upon the fact that n letters yield n(n-l) pairs or comparisons, 

4 2 

where ii is the number of letters in the column . For. example, in the case of 

a column of 3 letters, there are 3x2-3 comparisons. This can be checked 

.... g - ...... 

by noting that the 1st letter in the column, may be compared with the 2d, the 

2d with the 3rd, and the 1st with the 3rd, making 3 comparisons in all. The 

number of comparisons per column times the number of columns In the Superim-. 
diagram of 

position/ letters gives the total number of comparisons. The extension of 
this reasoning to the case, where a superimposition diagram has columns of. 
various lengths is quite obvious: one merely adds together the number of 

comparisons for columns of different lengths to obtain a grand total. For' 
convenience, the following brief table is given: 



’This has already been encountered (Footnote 3, Appendix 2, Military Crypt - 
analysis. , Part 2 . ) It is merely a special case under the, general formula for 
ascertaining the number of combinations that may be made of n different things 
taken r_ at a time, which is = nl . In studying coincidences by the 

n' v r i r J (n-r) I 

method indicated, since only two letters are compared at a time, r is always 
2; hence the expression nl , which is the same as n(n-l) (n-2) I , becomes 

rJ (n-r) J ^(n-2) J ’ 

by cancellation of (n-2) I, reduced to n(n-l). 

~~T, 



REF ID : A4 14 64 5 3 



- 108 - 



No. of 


No. of 


No. of 


NO. of 


No. of 


No. of 


letters. 


compa- 


letters 


compa- 


letters 


compa- 


in column " 


risons 


in column 


risons 


in column 


risons 


2 


1 


11 


55 


21 


210 


3 


3 


12 


• 66 


22 


231 


4 , 


6 


13 


78 


23 


253 


5 1 ' 


10 


14 ' ' 


91 


24 


276 


6 


15 


15 


105 


25 


. 300 


7 


21 


16 ' 


120 


.26 


325 


8 


28 


. 17 , 


136 


27 


351 


9 


36 


18 ' 


153 


28 


378 


10 


45 


19 


171 


29 


406 






20 ' ' 


190 


30 


435 ' 



g. ' In ascertaining tiie number of coincidences in the case of acolumn 

containing several letters /‘it is again necessary to use the formula n(n-l) , 

'■ 2 

only in this cash n is the number of identical letters in the column. The 

reasoning, of course, is the same as before. The total number of coincidences 

is the sum of the number of coincidences for each case of identity. For 

example, in the column shown at the side, containing 10 letters, there are 

C 3 B’s, 2 C’s, 4 K’s, and one Z. The 3 B’s yield '3 coincidences, the 
K 

B 2 C’s yield one coincidence, and the 4 K’s yield 6 coincidences. The 

K ... 

Z ' sum of 3 + 1-^6 makes a total of 10 coincidences in 45 comparisons. 

K ' 

C ~ 42. General procedure to be followed in making the K-test. - a. The 

B 

B steps in applying the foregoing principles to an actual case will now 
K 

be described. Suppose several messages enciphered by the same keying 
sequence but each beginning at a different point in that sequence are to be 
solved. The indicated method of solution is that of superimposition, the 
problem being to determine just where the respective messages are to be super- 



imposed so that the cipher text within the respective columns formed by the 
superimposed' messages will' be monoalphabetic. ; From what has- been indicated 
above, it will be understood that t.he various messages may be shifted relative 
to one another to many different points of super imposition, there being but 
one correct super imposition for each message with respect to all the others. 
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First, all the massages are numbered according to their lengths, the longest 
being assigned the number 1.- Commencing with"'m6ssages- 1 and 2, and keeping 
number 1 in a fixed position, message 2 is placed under it so that the initial 
"letters of the two messages coincide. Then the two letters forming the suc- 
cessive pairs of superimposed letters are examined and the total number of 
cases in which the superimposed letters are identical is- noted, this giving 
the observed number of coincidences. Next-, the total number of -superimposed 
pairs is ascertained, and the latter is multiplied by .0667 to 'find the expec- 
ted number of coincidences. If the observed number of coincidences is- consi- 
derably below the expected number, or if the ratio of the observed number of 
coincidences to tho'total number of comparisons is nearer .0385 than .0667, 
the superimposition' is incorrect and message 2 is shifted to the next' super- 
imposition, that is, so that its 1st letter is under the 2d of message 1. 

Again the observed ; number of coincidences is ascertained and is compared with 
the expected number. Thus, by shifting message 2 one space at a time (to the 
right or left relative to message 1) the coincidence test finally should indi- 
cate the proper relative positions- of the two- messages. ’’ When the correct 
point of superimposition is reached -the cryptanalyst is rarely left in doubt, 
for the results are sometimes quite startling. After messages 1 and 2 have 
been properly superimposed message 3 is tested first' against messages 1 and 2 

separately, and then against the same two messages combined at their correct 
5 

superimposition. Thus message 3- is shifted a step each time until- its correc 
position with respect to messages 1 and 2 has been found. - Then message 4 is 
taken and its proper point of supcrimpositlon with respect to messages 1, 2, 

g 

At first thought the student might wonder why it is advisable or necessary 
to test message 3 against message 1 and message 2 separately before testing 
it against the combination of messages 1 and 2, The first two tests, it 
seems to him, might be omitted and time saved thereby. The matter will bo 
explained in Par. 43f_(3). 




\ • 



REF ID : A4 14 6453 
- no - 

and 3 is- ascertained. The process is continued in this manner until the correct 
points of superimposition for all the messages have been found. It is obvious 
that as messages are added to the superimposition diagram, the determination 
of correct points of superimposition for subsequent messages becomes progres- 
sively more certain and therefore easier. 

b_. In the foregoing procedure it is noted .that there is necessity for 
ropeated displacement of one message against another or other messages. There- 
fore, it is advisable to transcribe the messages on long strips of cross- 
section paper, joining sections accurately if several such strips arc necessary 
to accomodate a long message. Thus, a message once so transcribed can be . 
shifted to various points of superimposition relative to another such message, 
without .repeatedly rewriting the messages. - 
. - c_. Machinery for automatically comparing letters in applying the coin- 
cidence. test has been devised. Such machines greatly facilitate and speed up 
the procedure. 

43. Example- of application of the K -test. - a. With the foregoing in 

messages, 

mind, a practical example will now be given. The following/assumed to be the 
first 4 of a series of 30 messages, supposedly enciphered by a long keying 
sequence, but each message commencing at a different point in that sequence, 
are to be arranged ^so as to bring them into correct superimposition: 

Message 1. 

PGLPN - H.UFRK S A U Q, Q, AQYUO Z A K G A EOQCN 

P R K 0 V H Y E I U Y N BON' N F D M W Z" L UK Q A Q A H Z . 

M G C D S LSAGC JPIVJ W V A U D BAHHI H K 0 R M 

LTFYZ LGS.OG K 
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Message. 2. . . . . i , . . . 

C W H P K KXFL1I ME U.R Y X G OP Y W N J : UJ . K W I.-H L . 

0 K Z T L • AIR DP GDDEZ , ,D L B 0 T- • F U Z N A . SR H H J. 

N G U Z K P R C D K Y 0.0. B. ¥ :D D. X C D ,0. G R G I RMICN 

HSGGO P Y. A 0 Y ; -/ X . . , , ... . ■■■ 

. • • Message 3. •- ... , . , 

W F W T D N H T G M R A A Z G P J D 3 Q, ., ; A U PER 0 X J R 0 . 

H R Z W C_ Z S R. T 2 . . E,E V P X . 0 A T D Q, L D 0 . Q Z .. H-A.W N X , 

THDXL . K Y I G K , V Y Z W X BE 0 0 ■ A Z Q, N D T NAL.T 

CNY.EH TSCT . . . .... ■ j ._ ; . 

Message 4. . ; •; 

T.ULD.H N q E Z Z UTYGD . • U E D U P ■ S D L I 0 ; L N N B, 0 

NY L Q Q V Q G C D U. TUBQ - X S- OS K .. N 0. X U V K C.. Y J-X ... 

C N J K S. A, NG U, I F T'O W. 0 M S S B q , DBA.IT , I K N W G.,--. 

?SKIE P : . ... 

6 

B. Superimposing messages 1 and 2, beginning with their 1st letters, 

33 

No. 1 . . . P G L P N H U F R K- S A U, Q. Q, A, Q Y, U-,0 Z A K G A E 0 Q C N P R. K •• 

No. 2 . . . C I HP KKXF L U M E U R Y X C 0 P H W N JU'JKWIHLOKZ 

.' ' * • . .? ■ fc>b 

No. 1 ... 0 V H YE I O'Y NBONNFDMWZLUKQAQ.AHZMGCDSL 
No. 2 ... T L A W R D F G D D E Z.D L B O T F U Z II A S R H H J- N-.G U Z K P - 

SI 

No. 1 ... E A G C J P I V J W- V A U D, B 'A,H M I E K 0 R M L T F Y : .Z L ,G S 0-G K 

No. 2 - .... R C D K Y 0 0 B V D D X C D 0 G R G I R M I C N H S G G 0 P Y A 0 Y X 

the number of coincidences is found to be 7. Since the total number of compari- 
sons is 101, the expected number, if the super imposition .were correct, should 
be 101 x ,0667 = 6,7367, or about 7 coincidences, ; The fact that the, observed 
number of coincidences matches the expected number on the very first trial 



6 " .. *. , 

The student will have to imagine the messages written out as continuous se quo iw 

cos on cross-section paper. 
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creates an element of suspicion: such good fortune is rarely the lot of the 

practical cryptanalyst. It is very unwise to -stop' at the first trial, even if 
the results are favorable , for this close agreement between theoretical and 
actual numbers of coincidences might just be "one of those accidents." There- 
fore message 2 is shifted one space to the right, placing its 1st letter beneath 
the 2d letter of message 1. Again the number of coincidences is noted and this 
time it is found to be only 4. The total number of comparisons is now 100; 

i ' . 

the expected number is still about 7. Here the observed number of coincidences 
is considerably less than the expected number, and when the relatively small 
number of comparisons is borne in mind, the discrepancy between the theoreti- ^ 
cal and actual results is all the more striking. The hasty cryptanalyst might 
therefore jump to the conclusion that the 1st superimposition is actually the 
correct one. But only two trials have been mado thus far and a few more are 
stili advisable, for in this scheme of superimposing a series of messages it 
is absolutely essential that the very first superimpositions rest upon a per- 
fectly sound foundation -- otherwise subsequent work will be very difficult, 
if not entirely fruitless. Additional trials will therefore be made, 

£. Message 2 is shifted one more space to the' right and the number of 
coincidences is now found to be only 3. Once again message 2 is shifted, to 
the position' shown below, and the observed number of coincidences jumps sudden- 
ly to 9. 

"3o 

No. 1 . . .P G L P N H U F R K S A U Q 0, A Q, Y U 0 2 A K G A E 0 Q G N P R K 

No. 2 . . .' C W H P K E X F' L U M K U R Y X C 0 P H W N 7 U W K W I H L 

““ • 

■ L'i 

No. ■ 1 .0 V H Y E I U Y N B 0 N N F D M W Z L U K Q, A Q, A H Z M G C D S L 

No. 2 ...OKZTLAIIRDFGDDEZDLB'OTI'UZUASR'HH JNOU 

Hi 

No. 1 . . .E A G C J P I V J W V A U D B A H M I H K 0 R M L T F Y Z L G S 0 0 K 
No. 2 ...ZKPRCDKYOOBVDDXCDOGRGIRMICNHSGGOPYA 

No, 1 ... 

No.- 2 ...0 Y X 
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The total number of comparisons is. now 98, so that the expected number . 
of coincidences is 98 x .0667 = 6.5366, or still about 7. The 2d and 3rd 
superimpositions are definitely incorrect; as to the 1st and 4th, the latter 
gives almost 30$ more coincidences than the former. Again considering the 
.'relatively small number of comparisons, this 30$ difference in favor of the 
4th superimposition as against the 1st is important. Further detailed expla- 
nation is unnecessary, and the student may now be told that it happens that 
the 4th superimposition is really correct; if the messages were longer, all 
doubt would be dissolved. The relatively large number of coincidences found 
■ at the 1st superimpositlon is purely accidental in- this case. 

d. The phenomenon noted above, wherein the observed number of coinci- 
dences shows a sudden increase in moving from an incorrect to a correct super- 
imposition is not at all iinusual, nor should it be unexpected, because there 
is only one correct superimposition, while, all other superimpositions are 
entirely incorrect. In other words, a superimposition is either. 100$ correct 
or 100 $ wrong — and there are no gradations between these two extremes. 
Theoretically, therefore, the difference between the correct superimposition 
and any ono of the many incorrect superimpositions should be very marked,- 
since it follows from what has been noted above, that one cannot expect that 
the discrepancy between the actual and .the theoretical number of coincidences 

should get smaller and smaller as one approaches closer and closer to the . 

7 

correct superimpos it ion. For if letters. belonging to the same cipher alpha- 
bet are regarded as being members of the same family, so to speak, then the 
two letters forming the successive pairs of letters brought into superimpos i- 

— — i ■ ... ■ . ’ — — V i .... i ...... — S . . 

7 

The importance of this remark will be. appreciated when the student comes to 
study longer examples, in which statistical expectations have a better oppor- 
tunity to come into play. 
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tion by an incorrect placement of one message relative to another are total 
strangers to each other, brought together by pure chance. This happons time 
and again, as one message is slid against the other — until the correct 
superimposition is reached, whereupon in every case the two superimposed 
letters belong to the same family. There may be many different families 
(cipher alphabets) but the fact that in every case there are two members of 
the same family represented causes the marked jump in, number of coincidences. 

e. In shifting one message against another, the cryptanalyst may move 
to the right constantly, or he may move to the left constantly, or he may 
move alternately to the left and right from a selected initial point. Perhaps 
the latter is the best plan. 

£. (1) Having properly superimposed messages 1 and 2, message 3 is 

next to be studied. Now it is of course possible to test the latter message 
against the combination of the former, without further ado. That is, ascer- 
taining merely the total number of coincidences given by the suporimposition 
of the 3 messages might be' thought sufficient. But for reasons which will 
soon become apparent it is better, even though much more work is involved, 
first to test message 3 against message 1 alone and against message 2 alone. 
This will really not involve much additional work after all, since the two 
tests can be conducted simultaneously, because the proper superimposition of 
messages 1 and 2 is already known.-- 'If the tests against messages 1 and 2 
separately at a given superimposition give good results, then message 3 can be 
tested,, at that superimposition, against messages 1 and 2 combined. That is, 
all 3 messages are tested as a single' set. Since, according to the scheme 
outlined, a set of three closely related tests is involved, one miglit as well 
systematize the work so as to save time and effort, if possible. With this 
in view a diagram such as that at the side (page 115) is made and in it the 
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coincidences are recorded in the appropriate cells. 




. 1 


2 ■ 


3 


to show separately the ..coincidences between messages 
1 and 2, 1 and' 3, 2 and 3, for each superimposition 
tested. The number of tallies in the cell 1-2 is 


f 

1 1 


X 


ttt* m 


H» - > 

■■ ■ i 


| 2 

i ^ __ 


X 


X 


Mr! i 

i 


the same at the beginning of all the tests; it has 


; 3 


x 

- 


X 


: I 

X 1 



^'already been found to be 9. Therefore , 9 tallies 



are inserted in cell 1-2 -to • begin with. : A column which shows identical letters 
in messages 1 and 3' yields a single tally for cell 1-3; a column which shows 
identical letters in messages 2 and 3 yields' a single tally for cell 2-3. ' 

Only when, a -superimposition yields..3 ...identical letters, in. a column, is a tally 
to be recorded simultaneously in. 'cells 1-3' ’and 2-3, since the presence of- 3 
identical lettors in the column yields 3 coincidences. * 

(2) Let message 3 be placed beneath messages 1 and 2 combined, so 
that the 1st letter of message 3 falls under the 1st letter of message 1. 

..(.It .is advisable to fasten the latter, in place . so that .they, cannot, easily, be 
disturbed.) Thus: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 13 19 20 21 22 23 24 25 26 27 

1 ... ’P GL'P N HUT R- K : S A U Q, : Q, « A ■ Q: X U' 0'-' Z''- A- K G .A- E 0 

2.. . CWHPKKXFLUMKUR YXC 0 P H W N J U 

3 ...-WF W T D N'H/T G M P.'- A A' Z ! G P. J' D-> S eQfvArsi-U -P' F" R >0 X 

28 29' 30 31 32 5 33 34 35 36 37 38 39-"- 40- 41"- 42 '43’ '44 :45 46 47-48 49 50‘-51 

1 ... Q, C N P RK0 V H Y E I If Y N B 0 NNF DMW Z 

2 . .." W K W I H L JJ K Z T "L’-A--W"R D F G D D E Z D L : B 

3 ... J R 0 H R Z ? C 2l S R,. T E E E V P X 0 . A T R Q L 

52 53 54 55 56 57 58.59 60 61 62 63 64 65 66 67 68 69 70.71 72 73 74 75 

1 . . . L U K Q, A Q, A 'E Z ' IS " G C' D S’ -L ' S A G C J P ' I' V : J 

2 ... 0 T F U Z N A S R II H J N G II Z K P R C D ,K Y 0 

3 ... 'D O' Q Z"'H A ''W N X <T H ' "D X L ' H' Y'l G" K V Y Z W' X 

.76 77 78 79- 80 81 82- 83 84 85 -86 87 38’ '89 90 ; 91 92 93 94 95 96 97 98 99 

1 . . . W V A U D B A H M I H K 0 R M L T F Y Z L G S . 0 

2 ... .0 B "V D D X C D ..C "r'G ..-'R:...G .1 ' :R.-M . C. N.-' II S: . G GOP 

3.. . BK0Q0AZ q'N D T N A L T C N Y E H T S C T 

100 101 102 103 104 

1 ... G K 

2 ... Y A 0 Y X 

3 ... 
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12 3 .-' The successive columns are now examined and the 

coincidences are recorded, remembering that only 
coincidences between messages 1. and 3, and between 
messages 2 and 3 aro now to be tabulated in the 
diagram. The results for this first test are shown 
in the diagram at the side. This suporimposition 
yields but 3 coincidences between messages 1 and 3, and the same number be- 
tween messages 2 and -3. The total numbers of comparisons are then noted and 
the. following table is drawn up: 



* 


nu 


ui 


> 


* 


m . 




X 


A 



Combination 


Total No. of 


No. of Coincidences 


i 

Discrepancy 




Comparisons 








Messages 1 and 3 


99 


about 7 


3 


-57$ 


Messages 2 and 3 


96 


" 6 


3 . 


-50$ 


Messages 1, 2, and 3 


291 

- • ; i 


" 19 


15 . 


-21$ 



(3) The reason for the separate tabulation of coincidences between 
messages 1 and 3, 2 and 3, and 1, 2, and . 3 should now be apparent. Whereas 
the observed number of coincidences is 57$ below the expected number of coin- 
cidences in the case of messages. 1 and 3 alone, and 50$ below in the case of 
messages 2- and 3 alone, the discrepancy between the expected and observed 
numbers is not quite so marked (-21$) when all three messages are considered ' 
together, because the relatively high number of* coincidences between messages 
1 and 2, which are correctly superimposed, serves to counterbalance the low 
numbers of coincidences between 1 and 3, and 2 and 3. Thus, a correct super- 
imposition for one of the three combinations may yield such good results as to 
mask the bad results for the other two combinations. 
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(4) Message 3 is then shifted one space to the right, and the same 

procedure is followed as before. The results are shown below: 

. . . ... J aS 

No. 1 . . ,P G L P N H U F. R K S ATJQQAQYUO ZAK’G-AE 0QCNPRK0.V 

No. 2 ... C W H P K K X F L U M K U R Y X.C O P H'W N J U W K W I S L 0 K 

No. 3 ... W F W T D N H T G M R A A Z G P J D S Q A U P F R 0 X J R 0 H R Z v; 

r*» 

No. 1 ...HYE IUYNB ONNFDMfZ L U K Q A Q A H Z M G C B S L E A G C 
No. 2 ...ZTLAWRDFGDD EZDLBO TFUZNAS RHHJNGUZKPI 
No. 3 ...G-ZSR TEEEVP XO AT D Q L D 0 Q Z H A .W N X T H D X L H Y I 0 

10 i 

No. 1 . . . J P I V J VI V A U D B A H M I H K 0 R M L T F Y Z L G S 0 G K 

No. 2 ...C DKYOOBfDDXCDO GRGI RMICNHS GGOP YAO YX 

No. 3 . . ,K V Y Z W, X B K 0 Q 0 A Z Q N D T N A L T CNYEHTSC T 



Combination 

Messages -.1 and 3 
Messages 2. and 3 
Messages 1,2 and 3 



* 


w, \\\\ 




> 


* 




. > 


> 


' 

> 



Total No. 
of Compa- 
risons 


No. of 
Coincidences 
Expected JObserved 


Disc re 
pancy 


99 

j 


about 7 


10 • • 


+43$ 


• - i 

97 


" : 6 


6 


0 $ 


293 


” 20 


25 

i 


+ 25$ 



Note how well the observed and expected numbers of coincidences agree in all 

three combinations. Indeed, the results of this test are so good that the 

cryptanalyst might well hesitate to make any more tests. 

(5) Having ascertained the relative positions of 3 messages, the 

fourth message is now studied. Hero are the results for the correct super- 

V- 

imposition. 



No. 1 ...P GLPNHUFRKSAUQQAQYUO Z A K G A E 0 Q C N P : R‘ K' 0 
No. 2 ... C. W ffP K K X F L^MKURYXC OPHWNJUWKW IHLO, 

No. 3 ... W F W^T DNHTGMRAAZGP JDS Q A U P F R 0. X J R 0 H R Z 

No. 4 ... TULDHN QEZZUTYGDUEDUPSDLIO.L N.N B 0 N;Y 

. " it 

No. 1 ... TH YE IUYNB 0 NN F DM1? Z L U. K Q A Q A H. Z- M G C D S LEA 
No. 2 ... KZTLAIEDFGDDEZDLBC TFUZNASRHHJ'NGUZI 
No. 3 ...W CZS RT EE EVP XO AT D Q L D 0 QZH AINX THDXL'HY 
No. 4 LQQVQGCDUTUBqXSOSKNOXUVKCY.JXCNJKSA 

No. 1 . . . G C J P I V J W V A U D B A H M I H K 0 R M L T F Y Z L G S 0 G K 

No. 2 ...PRC DKY 00BVDDXC DO G R G I RMI H’S GG.O P Y AOY X 

No. 3 ... I G K V Y Z W X B K 0 Q 0 A Z Q N D T N A L T C. N Y E H T S C T 

No. 4 . „ N G U I F T 0 W 0 M S N B Q D B A I V I K N W G V S H I E P 



AUQ'QAQYUO 
LiJMKURYXC 
RAAZGP JDS 
ZUTYGDUED 

N F D M W ZLU.K 
DEZDLBOTF 
X 0 A T D Q L D 0. 
B Q X S 0 S K N 0 
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Combination 


Total No. 
of , Compa- 
, risons 


Messages 1 and 4 


96 


Messages 2 and 4 


95 


• Messages 3 and 4 


96 


Messages 1,2, 


• . • i i 


• .... 3 and 4 


581 ' 



No. of 



Expected i Observed 




The results for an incorrect supefimposition (1st letter of message 4 under 

4th letter of message 1) are also, shown for comparison: 1 

No. 1 ... P G1P N H U F R K'S A U Q Q A Q, Y U 0 Z A K G A E 0 qCNPHKO 
No. 2 ... . . CWHPKKXFLUMKURYXCOPHWNJUWKWIHLO 

No. 3 ... W F W ID NHTGM R A A ; ZGPJD SQAUPFROXJRO HRZ 
No. 4 ... i. TUI D HN q E Z : ZUTY GDU EDUP S D L I 0 LNNB ON 

No. 1 .... V H Y E I U’ Y NBONN F..D M W Z. L U.K QAQAHZMG CD S L E A 
No. 2 ...KZTLAWRDFGDDEZDLBOTFUZNASRHHJNGUZK 
No. 3 ... W CZSRTEEEVPXOATDQLDO QZHAWNXTHD XL H Y 
Wo. 4 ... YLQ,Q,VQGCDUTUBQ,XSOSKNOXUVKCYJXCNJKS 

Wo. 1 GO J P I V J V! V AUDBAHMIHK.OR ML TFYZLGSOGK 

No. 2 . . . P ROD KY 0 0 BVDDX CDO G RG I RM I CNHS GGOPY AOYX 

No. 3 ... I G K V Y ZWXBKO Q, 0 AZQNDTNALT Cf YEHTSC T 

No. 4 ...ANGUIFTOWOMSNBQDBAIVIKNWGVSHIEP 




No. of 
Coincidences 



Expected 


Observed 


about 6 

. 


2 


M . 6' 


3 


« 6 


2 

1 


" 39 

• 


33 j 

.j 

i 



Disc re 



-67f 0 






-15 1o 

































REF ID : A4 14 64 5 3 



- 119 - 

(6) It is believed that the procedure has been explained with 
sufficient detail to make further examples unnecessary.. The student should 
bear in mind always that as he adds messages to the superimposition diagram it 
is necessary that he recalculate the number of comparisons so that the correct 
expected or theoretical number of coincidences will be before. him to compare 
with the observed number. In. adding messages he should see that the results 
of the separate tests, are consistent, as well. as those for the combined tests, 
otherwise ho may be led astray at times by the overbalancing effect of the 
largo number' of coincidences for the already ascertained,, correct superimposi- 

> i ' ’ j • • * ‘ ‘ ? 

tions. ’ 

. .44. Subsequent steps., - a. In Par. ,43a four messages were given of a . 
series supposedly enciphered by a long keying sequence, and, the succeeding 
paragraphs were devoted to an explanation of the preparatory steps in the solu- 
tion. The messages have now been properly superimposed, so that the text has 
been reduced to monoalphabetic columnar, form, and the matter is. now to be 
pursued to its ultimate stages. . „.. 

b. , ' The four messages employed in the. demonstration of the principles 
of the K -test have served their purpose.. ; . The information that they are 

messages enciphered by an intelligible running key, by reversed standard cipher 

* 

alphabets, was withheld from the student, for pedagogical reasons. ..Were the 
key a random sequence of letters instead of intelligible text, the explanation 
of the. coincidence test would. have been unchanged . in the slightest^ particular, 
so. far as concerns the mechanics of the- text itself. , Were the cipher alphabets 
unknown, mixed alphabets, the explanation of the K -test would also have been 
unchanged in the slightest particular. But, as stated before, the four messages 
actually represent encipherments by means of an intelligible running key, by 
reversed standard alphabets;’ they will now be used to illustrate the- solution 




of cases of this sort 
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c. Assuming now that the cryptanalyst is fully aware that the enemy is 
using the running key system with reversed standard alphabets (obsolete U. S. 
Army Cipher Disk), the method of solution outlined "in Par. 38 will be illus- 
trated, employing the first of the four messages referred to above, that be- 
ginning PGIPN HDFRK SAUQQ,. The word DIVISION will be taken as a probable 
word and tested against the key, beginning with the very first letter of the 
message. Thus: 

Cipher text .......... P G LPi H>' : U F U K S^A U Q Q ... 

Assumed text ........ . T D IT' I 'S I 0 N 

Resultant key text ... S 0 G X F ... 

The resultant key text is unintelligible and the word DIVISION is shifted one 
letter to the right. 

Cipher text P G L P N H U F R K S A U Q Q . . . 

Assumed text ......... DIVISION 

Resultant key text ... JTK , . . 

Again the resultant key text is unintelligible and the hypothetical word 

DIVISION is shifted once more. Continuation of this process to the end of the 

message proves that the word is not present. Anothor probable word is assumed 

REGIMENT. When the point shown below is. reached, note the results: 

Cipher text PGLPNHUFRKSAUQ,Q, 

Assumed text . . . . ; . ‘REGIMENT 

Resultant key text ... ELANDOFT 

It certainly looks as though intelligible text were being obtained as key text 

The words LAND OF T... suggest that THE be tried." The key letters HE give NO, 

making the plain text read ....REGIMENT NO... . The four spaces preceding 

REGIMENT suggest such words as HAVE, SEND, MOVE", THIS, etc, A clue may be 

found by assuming that the E before LAND in the key is part of the word THE. 

Testing it on the cipher text gives IS for the plain text, which certainly 

indicates that the message begins with the word THIS. The latter yields IN 
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for the first two key' letters. And so on, the process of checking one- text 
against the other continuing until the entire message and the key text have 
been reconstructed. ' . • ...... • ... ••• 

_d. Thus far the demonstration has employed but one of- the four messages 
available 'for solution. When the reconstruction process is applied to all 
four simultaneously it. naturally goes much faster, with reduced necessity for 
assuming words after an initial entering wedge has been driven. into one message 
For example, note what happens in this case; just as soon as the word REGMENT... 



is tried in the proper place': - 



Key text 


L* 


• 


• 


« 


E 


L 


A 


N 


D 


0 


F 


T 




• 


• 


• • • 


No i f Cipher text . . . 


. 1 . - 

P| G 




r 

r 


N 


H 


U 


F 


R 


K 


S 


A 


u 


Q, 


Q 


• • • 


(Plain text .... 




• 


• 


. 


R 


E 


,G 


I 


M 


E 


N 


.T 


• 


■ •. 


• 


• • • 


f Cipher text. ... > 
No * ^ (Plain text .... 


" 

. 


h— ' 




c 

• 


W 

I 


H 

E 


P 

L 


K 

D 


K 

T 


.X 

R 


F 

A 


L 

I 


u 

• 


M 

• 


K 

• 


• • • 


„ (Cipher text ... 


■ • 


l-W 


F 


w 


T 


D 


N 


H 


T 


G 


M 


R 


A 


A 


Z 


• • • 


3 t Plain text .... 




... 

• 


• • 




L 


I 


H 


G 


K 


I 


T 


C 


. • 


• 


• 


• • • 


.(Cipher text 
No. 4 <p lain text (>ii 




— 


T 

.. 


u 

• 


L 

T 


D 

I 


H 

T 


N 

A 


Q 

N 


E 

K 


z 

G 


z 


u 


T 


Y 


• • • . ^ 



It is obvious that No. 2 begins with FIELD TRAIN; No. 3, with ROLLING KITCHEN; 
No. 4 with ANTITANK GUN. These words yield additional key letters, the latter 
suggest additional plain text, and thus the process goes on until the solution 
is completed. 

e. But now suppose that the key text that has been actually employed 
in encipherment is not intelligible text. The process Is still somewhat the 
same only in this case one must have at least two messages in the same key. 

s . . • - . •_ .. ■ l I . 

For instead of checking a hypothetical word (assumed to be present in one 
message) against the key, the same kind of a check is made against the other 
message or messages. Assume, for instance, that in the case just described 
the key text, instead of being intelligible text, were a series of letters . 
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produced by applying a rather complex transposition to an originally intel- 
ligible key text. Then if the word REGBIENT were assumed to be present in 
the proper place in message No, 1 the resultant keyletters would yield an 
unintelligible sequence. But these keyletters when applied to message No, 2 
would nevertheless yield. lEIBTRApf; when applied to message No. 3, LINGKITC, 
and so on. In short, the text of one message is checked against the text of 
another message or messages ; if the originally assumed word is correct, then 
plain text will be found in the other messages, 

f, All the foregoing work is, of course, based, upon a knowledge, of the 
cipher; alphabets employed in the encipherment. What if the latter are unlaipwn 
sequences? It may be stated at once that not much could be done with but four 
messages, even after they had bo? 11 superimposed correctly, for the most that 
one would have in the way of data for the solution of the individual columns 
of text would be four letters per alphabet -- which is not nearly enough. 

Data for solution by indirect symmetry by the detection of isomprphs cannot be 
expected, for no is omorphs are produced in this system. Solution can be reach-? 
ed only |f there is sufficient text to permit of the analysis of .the columns 
of the superimposition diagram. When thore is this amount of tpxt there are 
also repetitions which afford bases for the assumption of probable words. 

Only then, and after the values of a few cipher letters have been established 

' ■■ 7. v jf’'" '"-fi - : trim ; "■ r- : r 'v • 

/ ••'* ft f • l ' ' . ' •» • - = 

can indirect symmetry be applied to facilitate the reconstruction of the pri?- 

, 17 ■ ■ ■":. !-5: 7;- 7* . •! .■ V ^ j -■ 77 . $$ 

mary components - if used. 

Even when the volume of text i s groat enough so that each column 

a;v-i , • ■ • * '' y-j •••;. 7 ‘ . /*'■ ■ ' *•*. ■ . 1 ' ■ 

contains say 15 to 20 letters, the problem is still not an easy one. But 

l”s|’ I'vi'pl jf4f£. 3*1 f ? s ■ 7 Vi , i 7‘.' f- V ;•» ■< '• *.*•• ■; r U '-y >. % 

frequency' distributions with 15 to 20 loiters can usually bo studied statisti- 

I'lfM'llf s / •• ,v :?• / ■ " " ; 

cally^ so that if two distributions present similar characteristics, the latter 

* 7 i i'' •;( if '' v * a ' : 7 • ' - ' '' V 1 

mpy'be used as a basis. for combining distributions: which pertain to the same 
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cipher alphabet. The next section will be devoted to a detailed- treatment of 
the' implications of the last statement.' 

■- SECTION XII ’ ' 1 

" THE : ‘M^TCHINB OF EEffiQUENCY DISTRIBUTIONS.' ’•* 

‘ Paragraph 

Preliminary . remarks. ~ 45 

The "Cross-product" or " X— test" in cryptanalysis . 46 

Der l vat ion of the X —tost ............... ...... v . ...... ............. 47 

Applying the X -test in matching distributions.'. ........ .V. .... . 48 

Practical example of applying the X -test. 49 

The "<{),( Phi j -test". . 50 

Deri vat, ion. of the ~-*test. ......... ................ ............... 51 

Applying the (j) -test. ..... . . . . .'. .... . . .’. 52 

45. Preliminary remarks. - a. The real purpose of making the coincidence 
test in cases such as that studied in the preceding section is to permit the 

... ..... . > ' ' ■> “ - ' J ‘ ’* ■ ’* J • ■ - 

cryptanalyst to. arrange his data so as to circumvent the obstacle which the 
enemy, by adopting a complicated polyalphabetic scheme of encipherment, places 
in the way of solution. The essence of the matter is that by dealing indivi- 
dually with the respective columns of the super imposition diagram the crypt- 
analyst has. arranged the polyalphabetic text so that it can be handled as. 
though it were mo noalphabet ic. Usually, the solution of the latter is a rela- 
tively easy matter, especially if there is sufficient text in the columns, cr 
if the letters within certain columns can be combined into single frequency 
distributions, or if some cryptographic relationship can be established betwec 
the columns, 

b, It is obvious that merely ascertaining the correct relative position; 
of the ; separate messages of a series of messages in a superimposition diagram 
is only a means to an end, and not an end in itsolf. The purpose is, as alre-L 
stated, to roduce the complex, heterogeneous, polyalphabetic text to simple, 
homogeneous, monoalphabetic text. But the latter can be solved only when there 
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are sufficient data for the purpose — and that depends often upon the type of 
cipher alphabets involved. The latter may be thb secondary alphabets result- 
ing from the sliding of the normal sequence against its reverse, or a mixed 
component against the normal, and so on. The student has enough information 
concerning the various cryptanalytic procedures which may be applied, depend- 
ing upon the circumstances, in reconstructing different types of primary com- 
ponents and no more need be said on this score at this point, • 

c_. The student should, however, realize one point which has thus far 
not been brought specifically to his attention. Although the superimposition 
diagram referred to In the preceding subparagraph may be Composed of many 
columns, there is often only a relatively small number of different cipher 
alphabets involved. For example, in the case of two primary components of 26 
letters each there is a maximum of 26 secondary cipher alphabets. Consequently 
it follows that in such a case if a superimposition diagram is composed of 
say 100 columns, certain of those columns must represent similar secondary 
alphabets. There may, and probably will be no regularity of recurrence of 
these repeated secondaries, for they are used. in a manner directly governed by 
the letters composing the words of the key text or tho elements composing the 
keying sequence, 

d. But the latter statement offers an excellent clue. It is clear that 
the number of times a given secondary alphabet is employed in such a superim- 
position diagram depends upon the composition of the key text. Since in tho 
case of a running-key system using a book as a key tho key text constitutes 
intelligible text, it follows that the various secondary alphabets will be 
employed with frequencies which are directly related to the respective fre- 
quencies of occurrence of letters in normal plain text . Thus, the alphabet 

j . - • 

corresponding to keylotter E should bo tho most frequently used; the alphabet 
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corresponding to keyletter T should bo next in frequency, and so on. From 
this it follows that instead of being confronted with a problem involving as 
many different, secondary cipher alphabets as there are columns in the super- 
imposition diagram, the cryptanalyst will usually have not over 26 such alpha- 
bets to deal with; and allowing for the extremely improbable repetitive use 
of alphabets corresponding to koylotters J, K. Q,, X, and Z, it is likely that 
the. cryptanalyst will have to handle only about 19 or 20 secondary alphabets. 

e. Moreover,, since the E secondary alphabet will be used most frequent J., 
and so on, it is possible for the cryptanalyst to study the various distribu- 
tions for the columns of the superimposition diagram with a view to assembling 
those distributions .which belong to the same cipher alphabet, thus making the 
actual determination of values much easier in the combined distributions than 
would otherwise be the case. . 

,f_. However,, if the keying sequence does not itself constitute intelli- 
gible. text, even if. it is a random sequence, the case is by no means hopeless 
of solution — provided there is sufficient text within columns so that the 
columnar frequency distributions. ..may ..afford indications enabling the crypt- 
analyst to amalgamate a large number of small distributions into a smaller 
number of larger distributions. 

In this process of assembling or combining individual frequency dis- 
tributions which belong to the same cipher alphabet, recourse may be had to a 
procedure merely alluded to in connection with previous problems, and designal 
ed as that of "matching" distributions. The next few paragraphs will deal wit. 
this important subject. 

46, The "Cross-product", or "X-test" in cryptanalysis. - a. The studor.t 
has already been confronted with cases in which it was necessary or desirable 
to reduce a large number of frequency distributions to a smaller number by 



identifying and amalgamating distributions which belong to the same cipher 
alphabet. Thus, for example, in a case in which there are, say, 15 distribu- 
tions but only, say, 5 separate cipher alphabets, the difficulty in solving 
a message can be reduced to a considerable degree provided that in the 15 
distributions those which belong together can be identified and allocated to 
the respective cipher alphabets to which they apply* - 

b. This process of identifying distributions which belong to the same 
cipher alphabet involves a careful examination! and comparison of the various 
members of the entire set of distributions to ascertain which of them present 
sufficiently similar characteristics to warrant their being combined into a - 
single distribution applicable to one of the cipher alphabets involved in the 
problem. Now when the individual distributions are fairly large, say contain- 
ing over 50 or 60 letters, the matter is relatively easy for the experienced 
cryptanalyst and can be made by the eye; but when the distributions ore small, 
each containing a rather small number of letters, ocular comparison and identi 
fication of two or more distributions as belonging to the . same alphabet become 
quite difficult and often inconclusive. In any event, the time required for 
the successful reduction of a multiplicity of individual small distributions, 
to a few larger distributions is, in such cases, a very material factor in 
determining whether the solution will be accomplished in time to bo of actual 
value or merely of historical interest. 

sum 

c, However, a certain statistical test, called the "cross -product" /or 
"X-test", has been devised, which can be brought to bear upon this question, 
and, by methods of mathematical comparison, eliminate to a large degree the 
uncertainties of the ocular method of matching and combining frequency distri- 
butions, thus in many cases' materially reducing, the time required for solution 
of a complex problem. 
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d. It is advisable to point out, however, that the student must not 
expect too much of a mathematical method of comparing distributions, because 
there are limits to the size of distributions to be matched, below which these 
methods will not be effective. If two distributions contain some similar 
characteristics the mathematical method will merely afford a quantitative 
measure of the degree of similarity. Two distributions may actually pertain 
to the same cipher alphabet but, as occasionally happens, they may not present 
any external evidences of this relationship, in which case no mathematical 
method can indicate the fact that the two distributions are really similar ana 
belong to the same alphabet. 

47, Derivation of the X(Chi) -test. a. Consider the following plaint-text 
distributioh of 50 letters: 

^ — g-v ^ .... js. - 'as '3s 3? " It 3^ jjc 

ABC - D E T G H I J K L M N' O P Q R S T U V W X Y Z 

In a previous text 1 it was shown that the chance of drawing two identical 

letters in normal English telegraphic plain text is the sum of the squares of 

tho relative probabilities of occurrence of the 26 letters in such text, which 

is .0667. That is, the probability of monographic coincidence in English 

telegraphic plain text is K - .0667. In tho message to which the foregoing 
• P •• 

distribution of 50 letters applies, the number of possible pairings (compari- 
sons) that can be made betxveen single letters is 50 x 49 - 1225." According 

2 

to the theory of coincidences there should, ' therefore, be 1225 x .0667 = 81.7065 
or approximately 82 coincidences of single letters. Examining the. distribution 
it is found that there are 83. coincidences, as shown below: 

s _ = -5 _ s. 3 . a 5 i — § S ^ is " 

ABC DEF GH I JKLMNOP Q R S TUVWX Y.Z. 

3-+ 0+ 0 + 1+21+ 0+0 + 1V3+ 0 -tO 4 0 + 1+10+15+ 0 -+ 0 +• 1+10+15 + 1 + 0 + 1-40+0+0= 83 



^Military Cryptanalysis , Part II , Appendix 2. 
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The actual number of coincidences agrees very closely with the theoretical 
number, which is of course to be expected, since the text to which the distri- 
bution applied has been indicated as being normal plain text. 

b. In the foregoing simple demonstration, lot the number of comparisons 

that can be mado in the distribution be indicated symbolically by N(N-l ) , where 

: ■; ... •• •. ... 2 

N - the total number of letters in the distribution. Then the expected number 

of coincidences may be written as .0667N(N-1) , which may then be rewritten as 

V • • . ... : 2 ■; i '. :••• 

■ (I) .0667N 2 . ;0667N !.:'•■> M : , ' • . • ;• 

2 



c_. Likewise, if f A represents the number of occurrences of A in the fore 
going distribution, then the number of coincidences for the letter A may be 

indicated symbolically by f^(f^ -l). And similarly, the number of coincidences 

.. _ _ — 

fof the’ letter 1 B may be indicated by fg(fg-l), and so on down to f z (f z -l) . 

2 ", 2 

The total number of actual coincidences found in the' distribution is, 'of course 

the sum of f A ( f A -l) f B ( fg-l} . .f^(f z -l). If 'the symbol f r is : used to 

_____ -4 — - 4 '..-.—-^— _ , 

indicate any of the letters A, B, ...Z, and the symbol ' is used to indicate 
that the sum of all the elements that follow this sign is to be found, then 
the sum of the actual coincidences noted in the distribution may be indicated 

v 

thus: < — f A (f -1) , which may be re-written ns 

f7 & 



■ (II) <; 

-■ - 2 

d. Now although derived from different sources, the two expressions 
labeled (I) and (II) above are equal, or should be equal, in normal plain text 0 
Therefore, one may write: . 

- f ft 2 -f ? s .0667 2 -.0667N 

' - - P o 
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f 0 2 - N = .0667N 2 - .0667N, 



Simplifying this equation: 

(m) f a 2 -*> f c = .C667N 2 - .06.67N 

— * ^° W ^ f^ = N 

Therefore, expression (III) may be written as 

(IV) 

which on reduction becomes: 

(V) 2_f^ 2 = .0667N 2 .9333N ' 

This equation may be read as "the sum of the squares of the absolute frequen- 
cies of a distribution is equal to .0667 times, the square of the total number 
of letters in the distribution, plus .9353- times the total number of letters 

in the distribution." The letter Sg is often used to replace the symbol 

2 " ' • ' •' - 



9 ■ ■ .... 

_f. Suppose two monoalphabetic distributions are thought to pertain to 



A 



the same cipher alphabet. Now if they actually do belong to the same alphabet, 
and if they are correctly combined into a single distribution, the latter 
must still be monoalphabetic In character. That is, again representing the 
individual letter frequencies in one of these distributions by the general 
symbol f^, the individual letter frequencies in the other distribution by 
f- 0 , and the total frequency in the first distribution by Ny, that in the 
second distribution by Ng, then 

(VI) (f + f B ) 2 r .0667(11-] + ^) 2 + .9333(^4 Ng) 



Expanding the terms of this equation: 

2 . . <r- 2 



Q ■s.0667(N 1 -t SN^g+Ng ) + ,9333N 1 +..93S3N g 
1 12 2 

But from equation (V) 



• 2 2 

f 0 = ,0667N 1 \ .9333^ “and 



By "correctly" is meant that the two distributions are slid relative to each 
other to their proper superimposition. 
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2 . 2 - 

f^ - ,0667N 2 .9333N 2 , so that 



equation (VII) may be rewritten thus 

2 



.0667N-, -f .9333N-.-4 2 f . f ' L -j- ,0667Np -f~ .9333Ng s 

' e l 

.0667 (Nj 2 -* ZNjNg- + Ng 2 } + . 9333%-}- . 9333N 2 
Reducing to simplest terms by cancelling out similar expressions: 

S 2V« - * 066?(a: i ,i 2 ) * or 

1 IB " “ 



(VIII) 



f f • 

9 1 d 2 ... = .0667 



N 1 N 2 



. g. Hie last equation thus permits of establishing an expected value for 

the sum of the products of the corresponding frequencies of the two distribu- . 

• .• . sum. ... . 

tions being considered for amalgamation . The cross-produet/or X-test fon 

• • • ' • ' • _ , _ • . . . ..b\ 

matching two distributions is based upon equation (VIII) . 

48* Applying the X-test in matching distributions. - a_. Suppose the 
following two distributions aro to be matched: 



f ' ... ABC D E F G H I J K L K NOP P S T.U V W X Y Z 

fg ... A i C D E F G HI J K L M N OP Q, R S T U V W X Y Z 

Lot the frequencies be juxtaposed, for convenience in finding the sum of ‘the 

cross products. Thus: 

f_ ...14030100100100 1 00 3 2.2 1 0 1 3 0 2 N =26 

.1 ABC DEFGHIJKLMNOP Q, R.S TUVIXYZ 1 
fp ... 0 2 0 0 0 3 0 0 1 0,1 0 0 1 1 0 0 3 1 1 0 0,0 0 1 2 ...No : = 17 
2 

fa fa.. 0 8 0 0-.0' 3 0 0 1 0 0 0 0 0 1 0 0 9 2 2 0 0 0 0 0 4 
& 1 8 2 



In this case 






*. N.No = ,26 x 17'- 442 

1 Cj 
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V‘ - • • 

v l"°2 30 = .0711 



b_. ; The- fact that the quotient .( .0711) agrees very closely with the 
expected value (.0667) means that the two distributions very probably belong 
together or are properly matched. Note the qualifying phrase "very probably." 
It implies that there is no certainty about this business of matching distri- 
butions by mathematical methods. .The mathematics serve only as measuring 
devices,' so to speak,, which can. be .employed to measure the degree of similarity 
that exists. ... 

I ' c_. There are other mathematical or statistical tests for matching, in 

addition to the X'-test. Moreover, it is. possible to go further with theX.-test 
and f ind a measure of the reliance that may be placed upon the. value pbtained; 
but these points will be left for future discussion in subsequent texts. 

d_. One more point will, however, . here be, added in connection with the 
. X-test, Suppose the very same two distributions in subpar. a_ are again juxta- 
posed, but with f a shifted one interval to the left of the position shown in 
the subpar. of reference. .Thus: ..... .. ... 

f ...(1 4 0 3 0 1 0,0 1 0 0 1 0..0 1 0 0,3 2.2, 1.0 1. 3. 0 2 ... N, - 26 

) ®1 lABCDEFGHI JKLMNOPqR S' T TJ V W X Y Z ? " 

CB CD EFGHIJKL M- N OP Q, RSTU. 7.W. X Y Z A 
f ,,,(2 000300101001100 3 1 1 0 0 0 0 1 2 0 . . . Ng r 17 



Here < > f f - 24 342+3 = 10 and < f f a . 

*1 ti 2 ^ ^1 *2 - _10 = .0226 

• : ■ NjNg, ... , 442 . . ,. . . . 

The. observed ratio (.0226) is so much smaller than the expected (.0667) that 
it can be said that if the two d istributions. pertain .to the same primary com- 



ponents they are not properly juxtaposed. . In other words, the X— test may also 



be applied in cases where, two or more frequency ...distributions must be shifted 



relatively in order to find their correct juxtaposition. The theory underlying 






REF ID:A4146453 

, - 132 - 

this application of the X-test is, of course, the same as before: two mono- 

alphabetic distributions when properly combined will yield a single distribu- 
tion which should still be monoalphabet ic in character. In applying the Xu test 
in such cases it may be necessary to shift two 26-element distributions to 
various juxtapositions, make the test for each juxtaposition, and take as 
correct that one which yields the best value for the test, 

o_. The nature of the problem will, of course, determine whether the 
frequency distributions which are to be matched should be compared (l) by 
direct juxtaposition, that is, setting the A to Z tallies of one distribution 
directly opposite the corresponding tallies of the other distribution, as in 

subpar. a_, or (2) by. shifted juxtaposition, that is, keeping the A to Z tallies 

. . / 

of the first distribution fixed and sliding the whole sequence of tallies of 

the second distribution to various juxtapositions against the first. 

48. Study of a situation "in' which the X-test may be applied, - a. A 
simple demonstration of how the X-test is applied in matching frequency distri- 
butions may now be set before the student. The problem involved is the solu- 
tion of cryptograms enciphered according to the progressive-alphabet system 
(Par. 36b) , with secondary alphabets derived from the interaction of two iden- 
tical mixed primary components'. It will be assumed that the enemy has been 

using a system of this kind and that the primary components are changed daily,, 

) . 

Jb. Before attacking an actual problem of this type, suppose a few 
minutes be devoted to a general analysis of its elements. Consider a cipher 
square such as that shown in Fig. 25, which is applicable to the type of pro- 
blem under study. ; It has been. arranged in the form of a deciphering square. 

In this square, the horizontal sequences' are all identical but merely shifted 
relatively; the letters inside -the square .are plain-text letters . 
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ALPHABET NO . 





1 


2 


3 


4 


5 


6 


7 


.8 


9 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 22 


23 


24 


25 


26 




A 


fA U 


L 


I 


C 


B 


E F 


G 


J 


K 


M- 


N 


0 


P 


q 


S 


T 


Y . 


w 


X 


Z" 


H 


Y 


D 


■ R 




B 


B 


E 


F 


G 


■J 


K 


M 


;N. 


0 


P 


q 


■ S 


T. 


V 


W 


X 


Z 


H 


Y. 


D 


R 


A: 


U 


■ L 


1 


C 




C 


C 


B 


E 


F 


G 


J 


K 


M 


N 


0 


p 


q 


S 


T 


V 


w 


X 


Z 


H 


Y 


D 


R 


A 


U 


L 


I 




D 


D 


R 


A U 


L 


I 


C 


B 


E 


F 


G 


j 


K 


M. 


N 


0 


P 


q 


S 


T 


V 


W 


X 


z' 


H 


Y 




E 


E 


F 


G' 


J 


K 


M 


N 


0 


P 


q 


S 


T 


V; 


w.- 


' X 


z 


h; 


,X- 


D 


R 


A 


u 


L 


. I 


- C 


B 




F 


F 


G 


J 


K 


M 


N 


0 


P 


q 


s 


T 


V 


V/ 


X 


z 


H 


Y 


D 


R 


A 


U 


L 


I 


C 


B 


' E 




G 


G 


J 


K 


M 


N 


0 


P 


q 


s 


T 


Y 


W 


X 


z 


H 


Y 


D"- 


R 


A 


U 


L 


I 


C 


: :B 


E 


F 


- 


H 


H 


Y 


D 


R 


A 


U 


L 


i 


G 


B. 


E 


F 


G, 


J 


K-: 


M- 


' N" 


0- 


P 


q 


S., 


. T 


,v 


vW 


X- 


Zr 




I 


I 


C 


B 


E 


F 


G 


J 


K 


M 


N 


0 


P 


q 


s 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A 


U 


L 




J 


J 


K 


M 


N 


0 


P 


0. 


S 


T 


V 


w 


x. 


■ : Z 


H' 


• Y 


D 


R 


A 


u 


L 


I 


C 


B 


E 


F 


G 


(X- 


K 


K 


M 


N 


0 


P 


0, 


S 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A 


U 


L 


I 


C 


B 


E 


F 


G 


J 


i! : 


L' 


L 


I 


C 


B 


E 


F 


G' 


J‘ 


K 


■-M 


• N 


0- 


P- 


q 


: S 


■ T. 


:v^ 


W- 


X 


Z 


H 


Y 


D 


R 


A 


U 


N J 


M 


M 


N 


0 


P 


q 


S 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A. 


u 


L 


I 


c 


B 


E 


F 


G ' 


’ J 


K 


\ 


N 


N’ 


0 


P 


0. 


s 


T 


V 


w 


X 


• z- 


/H- 


Y 


D 


■ R 


A 


U 


L 


.1 . 


,C 


B- 


E 


F- 


G 


J 


K 


M- 


P5 


0 


0 


P 


q 


S 


T 


Y W 


X 


z 


H 


Y 


D 


R 


A 


U 


L 


I 


C 


B 


E 


■F 


G 


J 


K 


M ’ 


N 


§ 


P 


P 


Q 


s 


T 


V 


W 


X 


Z- 


H 


Y 


D 


R 


A 


U 


. L 


I 


c 


: B 


E 


F 


G 


J 


K 


M 


N . 


0 




Q 


q 


S 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A 


U 


L 


I 


C 


E 


E 


F 


G 


J 


K 


M 


N 


0 


■P 


o 


R- 


R 


A U 


L 


I 


C 


•B 


E 


F- 


■■'•G 


' J 


• K 


M' 


N' 


■ o: 


P- 


.q - 


S. 


T , 


; V 


.■■'ll: 


X: 


. Z 


H. 


Y 


D 




S 


s 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A 


U 


L 


I 


c 


B 


E 


F 


G 


J 


K 


M- 


N 


0 


P 


q 




T- 


: t 


V 


W 


X 


z 


H 


■Y 


D 


R 


A' 


U 


L 


-I 


: C 


■ B 


.E ' 


F 


,G> 


; J ■ 


K 


M ' 


i N 


0 


P 


q 


S 




U 


u 


L 


I 


c 


B 


E 


F 


G 


J 


K 


M 


N 


0 


P 


q 


S 


T 


V 


W 


X 


Z 


H 


Y 


D 


R 


A 




V 


V 


W 


X 


z 


H 


Y 


D 


R 


A 


u- 


■L" 


I ; 


: C. ■; 


: B -, 


E 


:F . 


. G 


, I 


,K. ■ 


M. 


. :N 


:0 


P 


q 


S. 


T 




W 


w 


X 


z 


H 


Y 


D 


R 


A U 


L 


I 


C 


B 


E 


F 


G 


J 


K 


M 


N 


0 


P 


q 


s 


T 


Y 




X 


X 


z 


H 


Y 


D 


R 


A U 


L 


I 


C • 


• B 


E- 


F 


G 


J . 


■ K 


m; 


N 


0. 


■ ?: 


: q 


s. 


- T 


V 


W. 




Y 


Y 


D 


R 


A U 


L 


I 


C 


B 


E 


F 


G 


J 


K 


M 


N 


0 


p 


q 


S 


T 


V 


w 


X 


Z 


H 




LzJ 


Z 


H 


Y 


_D_ 


_R_ 


A U 


L 


I 


C 


B . 


E 


F. 


G 


J 


K 


M 


N 


o- 


P 


q 


s 


T 


V 


w 


X 



(Plain-text letters are within the square proper. ) 




Figure 25. 



c_. If, for mere purposes of demonstration, instead of letters within 
the cells of the square there are placed tallies corresponding in number with 



the normal frequencies of the letters occupying the respective cells, the 
cipher square becomes -as follows (showing only the 1st three rows of the 
square): -••• 
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ALPHABET NO. 

1 2 34 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 




'ai'i s '_5-s - - ■' a. = = 'm 5. « ..'S * _ 
c 5 - 1 5 = s li? '£ _ ^ = s = s ^ 5L a ^ S. 

Figure 26. 

cl, It is obvious that here is a. case wherein if' two distributions per- 
taining to the square are isolated from the square,; the X-test (matching 
distributions) can be applied to ascertain how the distributions can be super- 
imposed and madei’to yield a monoalphabet ic composite. There is obviously one 
correct superimposition out of 25 possibilities. ■ In this case, the B row of 
tallies must be displaced 5 intervals to the right in order to match it and 
amalgamate it with the A row of tallies. Thus: 

^ = -1 = = ^ 5 - - - 

A, 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 



■g .= § = _ 

B 22 23 24 25‘26 1 



■§. si 

2 3 



4.56-7 



; s . Si — . n." ie - - = = - 

.8 9 10 11 12 13 14 15 16 17 18 19 20 



21 



Figure 27. 

e_. Note that the amount of displacement, that is,, the number of inter'- 

s’ 

vals the B sequence must be shifted to make it match the A sequence in Fig. .27. 

corresponds exactly to the distance between the letters A and B in the primary 

1 2 3 4 5 6 

components, which is 5 intervals. Thus: ...AULIGB... 

f_. Given a message in such a system, suppose the cipher letters are 
numbered from 1 to 26, or suppose the text is transcribed in rows of 26 letters. 
A square table of 26 frequency distributions is then drawn up, this sort of 
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distribution merely indicating by a tally in the appropriate column whenever 
the cipher letter at the left appears in the toxt. For example, in the illus- 
trative message above, there are no A’s; the 29th letter is a B, which belongs 

• ' • v • I ■_ . - - 

in the .3rd alphabet; so that in the distribution square a tally is inserted in 
row B, column 3, The 27th letter of the message is a C, which belongs in the 
1st alphabet; a tally is inserted in row C, column 1. The 37th, 38th, 39th 
and 53rd letters are D’s; they belong in the 1st, 11th, 12th and 13th alphabets* 
tallies are inserted, in row D, columns.!, 11, 12, and 13, Thus: 









K9 


H 


11 


D 


El 


Hi 






m 


BE 








m 


ra 


H 


E3 


m 


m 


m 


ED 


M 


m 




m 


HI 


HI 


HI 


Hi 


Hi 


Hi 


hi 


Hi 


i 


Hi 


H 


Hi! 


m 


m 


HI 


Hi 


m 


Hi 


HI 


Hi 


Hi 


hi 


m 


H 


















































m 


p 


Em 


■ 


Hi 




Hi 






Hi 


hi 


Hi 


Hi 


H 


■ 


Hi 


h 


m. 


H 




m 




H 


HI 


Hi 


m 


Hi 


i® 


In 


■i 


Hi 


HI 


Hi 


Hi 


m 


HI 


Hi 


Hi 


Hi 


n 


KB 


HI 


HI 


HI 




m 


m 


Hi 


Hi 


Hi 


■ 






m 



Figure 28. 



The process is continued in this manner until all the letters have been distri- 
buted and represented by tallies in the appropriate rows and cells in the rows. 
Such a distribution may be termed a frequency distribution square . 

g. When the distribution has been completed for the entire cryptogram, 
then the various horizontal sequences of tallies within the distribution square 
may be matched by the X -test and the primary components may be reconstructed, 
perhaps without making . any assumptions of values for cipher letters. The under- 
lying principle in this method of reconstructing primary components is that the 
sequences within the cipher square are identical and merely displaced various 
intervals, as pointod out in subparagraph c_. 

49, Example of. solution by foregoing principles. - a. The following cryp- 
togram has been enciphered according to the method indicated, by progressive, 
uninterrupted shifting of the cipher component against an identical plain com- 
ponent. v 
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W G J J M 


M M JXE 


D G C 0 C 


'ftrp b 


M I I I K 


Z R Y N N 




B U F R W 


W W W Y 0 


I H F J K 


OKHTT 


AZCLJ 


E P P F R 


, 


W C K 0 0 


FFFGE 


p'q R Y Y 


I I X MX 


U D I P F 


EXMLL 




W F K G Y 


PBBXC 


H B F Y.i 


E T X H F 


3 I V D I 


PNXIV 




R P W T M 


G I M P T 


EC J BO 


K V B u q 


G V G F F 


F K L Y Y 




CKBIlff 


XMXUD 


IPFFU 


Y N V S S 


I H R M H 


"YZHA U " 




Q W G K T 


I U X Y J 


J A 0 W Z 


OCFTR 


ppoqu 


S G Y C X 




Y C X U C 


JLMLL 


YEKFF 


z v q j q 


S I Y S P 


D S B B J 




U A H Y N 


W L 0 C X 


s d q v c 


Y V S I L' 


I W N J 0 


0 M A q S 




L1YJG 


T V P q K 


P K T L H 


SROON 


' I C- F E V 


M N V : W N • • 


• 


B N EH A 


MRCR.0 


V S T X E 


N H P Y B 


TWKUq 


I 0 C AV 




IB R q, N 


F J V NR" 


V D 0 P U 


• q r l k q 


N F F FZ 


P H U R V 




W L X G S 


H q W H P 


J 3 C N N 


j q s o q 


ORCBM 


R R A 0 N 




RKI'UH 


Y Y C If 


DGS JC 


TGPGR 


m i q m, p 


SGCTN 




M F G J X 


E D G C 0 


■PTGPW 


qqvq i 


IXTTT 


C 0 J V A 


■ 


A A B W m’ 


X I Hi 0 W 


H D E q U 


A I N F K 


F W H P J 


AHZIT 




W Z K F E 


X S R U Y 


q I 0 Y R 


' E R D J Y 


dk'hi'r 


.q w'e d g 




E B Y B M 


L A B J V 


T G F F G 


XT I V G 


R J Y E K' 


FBEPB 


• 


J 0 U A H 


C-UGZL 


XIAJK 


W DVTY 


B F R U C 


c c u z z 




I N N D F 


RJFMB 


H q L X H 


M H q Y Y 


Y M w q V 


C L I P T 




W T J Y Q, 


B Y R L I 


T U 0 U S 


RCDCV 


W D G I G 


G U B H J 




V V P W A 


B U J K N 


F P F Y W 


V q z q f’ 


L H T W J 


PDRXZ 




owns S 


G A M H N 


C W H S W 


W L R Y q 


qus z v 


D N X A N 


' ' - 


V N K H F 


U C V V S 


S S P l q 


U P C V V 


Y W DGS 


J 0 G T C 


J 


H D E V Q 


S I J P H 


q J A W F 


-R I Z D W 


XXHCX 


Y C T M G 




USESN 


D S B B K 


RLYIR 


VZEEP 


P P A T 0 


I A N'EE 




E E J N R 


C Z B T B 


L X P J J 


K A P P M 


J E G I K 


RTGF’F 
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H P' V V V 


Y K J E F 


H q S X J 


Q D Y V 


Z . ’ 


G R R R Z 


q;L y x k 


X A 20 W 


R R X Y K 


YGMflZ 


B Y N V 


H 


■q B R V F 


E F q L L 


W Z E "Y L 


JER0Q- 


S 0 Q, K 0 


M W I 0 


G 


,M B K F F 


L X D X T 


L W I L P 


Q, S ' E D Y 


I 0 EM 0 


■IBJ M 


t 


N N S Y K 


X J Z J M 


LCZB K ’ 


S D J W Q, 


X T J V L 


:f I R N 


R 


XHYBD 


BJUFI 


R J I r C T 


UUUSK 


K W D' V M 


F W T T 


J 


K C I( C G 


C V S A G 


Q, B C J M 


E B Y N V 


S S J K S 


D C B D 


Y ' 


F P P V F 


D W Z M T 


B P V T T 


' C G B V T 


: Z K H.Q D 


. D R M E 


Z 


0 0. 




jb. The 


message, for 


convenient handling, 


is 


transcribed. 


in lines of 



letters, as- shown below in Fig. 29. 

c_. Frequency distributions for the 26 columns of cipher letters are 
made, but in a slightly different arrangement than is usually the case. Here ' 
the cryptanalyst is interested not so much in what letters occur within each 
cipher alphabet as he is in the occurrence of a given cipher letter. in the 
various alphabets.. 'The tabulation is therefore made in. the form of a distribu- 
tion square in which the cipher letters are shown 'at the left, the column or 
alphabet numbers at the top. Whenever a .given cipher letter occurs a tally is 
inserted in the row marked by that letter, and in the cell in -that row corres- . 
ponding to-' the column number in which the letter, occurs,. 

d." Since theX-test is a purely statistical test and becomes increasing- 
ly reliable as the size of the distributions increases, it is best to start by 

' , r’> , ■ 

matching the two distributions having the greatest numbers of tallies. .These 
are the V and W distributions, 'with 53 and 52 occurrences, respectively. Here 
are the results of several trials: u 
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1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


|5 


16 


•7 


18 


t9 


10 


11 


22 


23 


14 


25 


26 


1 
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First Test 



Cl 0 2 0 0 
(1 2 3 4 5 



264800700211111064024 
6 7 8 9 (0 |1 12 |3 14 i5 16 <7 18 |9 2.0 £22 23 24 25 26 



(34 2516 1 2 3 4 5 6 7 8 9 10 11 12 IS |4 15 *6 /7 J8 19 1021 22 23 
(0 4 21,1 5 301 002 81 7 601 0023 02 1.2 



. 0 0 4 0 0 10 18 O' 8 0 0 14 0 0J4^ 0 1 0 0 018 0 0 2 8 



¥| z 103 = .037 



Second Test 



Ny =. 53 
%-52 . - 

^ f V% = 103 



(1 0200 2 64800700 2 11. 1 110 6 4024 Nr 53 
[1 2 3 4 5 6 7 8 9 10 II |2 13 14 15 16 17 <8 19 20 21 22 23 24 25 26 V 

H8 1920 21 ?2 13 24 25 26 1 2 3 4 5 6 7 8 9 |0 <1 12 13 14 15 16 17 

.[2 30 2 12042115 3. 0100 2 8 1 7 60100 % = 52 



f y f w 2000040 16 16 0 055 002 0 0 2 8 1. 0 36 0 0 00 

^ f V% ■ r . = * 044 

vrvr — 2756 



fvfw s 122 



Third Test 



f (1 0 2 00264800 7 002111 IT 0 64024 EU = 53 

(1 2345678 9 10 ll 12 13 14 15 16 <7 18 19 3D 21 12 23 24 25 26 

(456 7 8 9 10(1 12 I3./4 >5 »6 17 18 19 20 21 Z2 23 St 25 26 1 2 3 

2,13 0 1 0 0.2 8 1 7 6 .0 1 0. 0 2 3 0, 2 1 2 0 4 2 1 1, 5 N- = 52 



f V f W 3 02 004*26456 0 0 7 0 0 4 3 0 2 1- 2 0£4 8 0 220 



. f V% ;. 190 - .069/ 






2756 






e_. Since the last of the -three foregoing tests gives.. a value somewhat 
better than the expected .0667 ; it looks as 'though the : correct position of the ' 

W distribution with reference to the i J distribution has been found. In practice s 
several more tests would be made to insure that other close' approximations to - 
-.0667 will not be found, but these will! here be- omitted. The test ; indicates 
that the primary cipher component has the letters V and w! in these positions : 
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12 3 4 

V . . W, since the correct superimposition requires that the 4th cell of the W 
distribution must be placed, under the 1st cell of the V distribution (see the 
last superimposition above). 

_f . The next best distribution with which to proceed is the F, with 51 

occurrences. Paralleling the procedure outlined in Par. 43, and for the same 
reasons, the F sequence is matched against the W and V sequences separately 
and then against both W and V sequences at their correct superimposition. The 
following shows the correct relative positions of the three distributions: 

Ny = 53 



r Cl 0200264800700211111064024 

Mi 



2 3 4 5 6 7 8 9 lOU 12 13 14 15 16 (7 18 19 20 21 22 23 2425 26 



L F 



C8 9 10 1112 

\1 1 2 1 0 



13 1415 16 17 18 19 20 ?1 22 23 24 25 26 1 2 3 4 5 6 7 
06393020002111 2 04 2037 



f y f F 1 0 4 0 0 036I2T2 0 014 0 0 0 2 11 1 2 0£4 8 0 6 28 



f V f F 212 






2703 



s .078 



%■ = 5 i : 



,Vf = 212 



e i . 

i 



530100281760100230212042 
3 4 5 6 7 8 9 10 II 12 13 14 15 16 17 18 49 20 21 22 23 ^4 25 26 



5 6 7 8 9 10 1112 1314 (5 16 17 18 19 20 ZL 22 23 24 25 26 1 2 3 4 
F |03711210063930200021112042 

f f 0 335 3 0 2 0 0 'OKB 3&3I8 0 2 0 0 0 6 0 2 1 4 016 4 
W F 



Vf 



%% 



= ^ 1 ° = .078 

2703 



N w 52 



% = 51 



f f 
W F 



= 2io 



f C 4 030 0 4145 15 6 08004413230 (0 6 1 39 
V+W |l 2 3 4 5 6 7 8 9 10(112 13 1415 16 17 (8 19 302122 23 2425 26 



C 8 9 (0 (1 
1 2 1 



'8 9 (0 (1 (2 |3 14 (5 16 17 18 19 20 2122 23 24 25 26 1 2 3 4 5 6 7 
0063930 2 0002111204203 7 



f f 4 0 6 0 0 02415 tffMTOiB 0 0 0 8 1 3 2 6 0 <OI 2 0 9&3 
V+.TV F 



f r f 
V IF 



W^F 



r 422 = .079 

5355 



%+W = 105 



N : 51 • 
F 



^V+.V^F = 422 
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12345 6 78 

The test yields the sequence V . . W . . . F . 

g, The process is continued in the foregoing manner until the entire 
primary component has been reconstructed. It is obvious that as the work pro- 
gresses the cryptanalyst is forced to employ smaller and smaller distributions, 
so that statistically the results are apt to become less and less certain. But 
to counterbalance this there is the fact that the number of possible superim- 
positions becomes progressively smaller as the work progresses. For example, 
at the commencement of operations the number of possible points for superim- 
posing a second sequence against the first is 25;- after the relative positions 
of 5 distributions have been ascertained and a 6th distribution is to be placed 
in the primary sequence being reconstructed, there are 21 possible positions; 
after the relative positions of 20 distributions have been ascertained, there 
are only 6 possible positions for the 21st. distribution, and so on. 

h. In the foregoing case the reconstructed primary component is as 

follows : ' .■ 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24-25 26 ' 

VALWNOXFB P Y R C Q, Z I G S, E .11 T . D. J U M K . 

jL. Of course, it is probable that in practical work the process of 

matching distributions would be interrupted soon after the positions of only 

a few letters in the primary components had been. ascertained. For by trying 
partially reconstructed sequences on the cipher text the skeletons of some 
words would begin to show. By filling in these • skeletons with the words 
suggested by them 1 , the process of reconstructing the components is much facili- 
tated and hastened.' - 

j_. The ■ components having been reconstructed, only a moment or two is 

necessary to ascertain their initial position in enciphering the message. The 
plain text may then be obtained without further delay. It is as follows: 
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WITH THE DjPROVEMENTS'IN THE AIRPLAINE AND THE MEANS OF COMMUNICATION AND WITH 
THE VAST SIZE OF MODERN ARMIES STRATEGIC SURPRISE WILL BECOME HARDER AND HARDER 
TO ATTAIN X IN THE PRESENCE OF MODERN AVIATION AMD FAST MOVING MECHANIZED ' 
ELEMENTS GREATER COMPLEXITIES MORE SUBTLE DECEPTIONS STRATEGEMS AND FEINTS WILL 
HAVE TO BE EMPLOYED X IN MODERN WARFARE IT IS STILL POSSIBLE TO GAIN TACTICAL 
SURPRISE BY MANY MEANS X WHILE THE MEANS OF OBSERVING AM) TRANSMITTING INFORMA- 
TION OF TROOP MOVEMENTS ARE GREATLY IMPROVED OVER THOSE OF THE PAST THE MECHA- 
NICAL MEANS OF MOVING TROOPS ARE LIKEWISE FAR SPEEDIER X ALSO FAISE INFORMATION 
CAN HE FAR MORE EASILY AND QUICKLY DISTRIBUTED X THE LESSON TO BE LEARNED FROM 
THE OPENING PHASE OF ALLEN BYS BATTLE OF MEGGIDO IS THAT SURPRISE IS POSSIBLE 
EVEN IN MODERN WARFARE BUT ONLY BY PERFECT DISCIPLINE ON THE PART OF THE TROOFS 
AND ALMOST SUPERHUMAN FORETHOUGHT AND ATTENTION TO DETAIL ON THE PART OF THE 
STAFF BACKED UP BY RESOLUTE. ACTION IN THE AIR X TO MAINTAIN SECRECY MOVEMENTS 
MUST BE UNDER COVER OF DARKNESS AND COVERED BIVOUAC AREAS MUST BE OCCUPIED 
DURING DAYLIGHT HOURS X UNOBSERVED DAYLIGHT MOVEMENTS WILL REQUIRE 'THE RESTRIC- 
TION OF HOSTILE AIR OBSERVATION BY ANTIAIRCRAFT ARTILLERY AND COMBAT AVIATION. 

k. The student should clearly understand the real nature of the matching 
process employed to such good advantage in this problem. In practically all 
the previous cases frequency distributions were made of cipher letters occurring 
in a cryptogram, and the tallies in those distributions represented the actual 
occurrences of cipher letters. Furthermore, when those distributions were com- 
pared or matched, what wore being compared were actually cipher alphabets. 

That is, the text was arranged in a certain way, so that letters belonging to 
the same cipher alphabet actually fell within the same column and the frequency 
distribution for a specific cipher alphabet was made by tabulating the letters 
in that column. Then if any distributions were to be compared, usually the 
entire distribution applicable to one cipher alphabet was compared with the 
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entire distribution applying to another cipher alphabet. But in the problem 
just completed, what were compared in reality were not frequency distributions 
applying to the columns of the cipher text as transcribed in Fig. 29, but were 
graphic representations of the variation in the frequency of use of plain-text 
letters falling in identical sequences , the identities of these plain-text 
letters being unknown for the moment . Only after the reconstruction has been 
completed do their identities become known, when the plain text of the crypto- 
gram is established. 

1, . One final remark may be added in connection with the problem just 

completed. . In. some cases the procedure indicated, involving the matching of 

. \ ' 

distributions, may .not be feasible because of the paucity of text. Yet there 
are sufficient data, in the respective alphabets to permit of some assumptions 
of values of cipher letters, especially if there arc a few repetitions to assist 
in making correct assumptions. Then if the tentative values thus obtained are 
inserted within a reconstruction diagram applicable to tho entire cipher 
square, it is likely that not only will the cryptanalyst be likely to find 
data for use in reconstructing the primary components by indirect symmetry, 
but also he will probably find certain data of direct assistance in the recon- 
struction. For example, suppose for the sake of simple illustration the 

cryptanalyst has been fortunate in making a good guess and has the phrase AM) 

line 2, 

THE located in the foregoing message, in/columns 7-12, incl. The cipher equi- 
ANDTHE 

valents are"F R I If W W. The four sequent W*s mean that the primary component 
contains the sequence DTHE if the cipher component is sliding toward the right, 
or EHTD, if toward the left. (Whichever direction is correct is of no conse- 
quence, so long as the cryptanalyst is consistent in setting down the results.) 
Reference to the primary component reconstructed in subpar. h shows that EHTD 
indeed forms a sequence in that component. In other words, identical cipher 
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letters in sequence in this system mean that the plain-text letters they 
represent are sequent in the primary component. Going one step further, the 
interval between identical cipher letters in the cipher text corresponds to 
the interval between their equivalent plain-text letters in the primary compo- 
nent. Thus, the 2d and 12th cipher letters in the illustrative message above 

are G's; they represent I and 0 , respectively. Therefore, in the primary 

P p 

component the letters 0 and I are separated by 10 intervals (or 16, depending 
upon the direction of ' displacement ) . By applying these principles, with per- 
haps the addition of data from indirect symmetry, the entire primary component 
can often be reconstructed from a relatively small number of correct ..assump- 
tions for the values of cipher letters. 

50. The $ (Phi)-test. - _a. The student has noted that the ■Xrtest is 

based upon the general theory of coincidences and employs the probability 

constants K and K .. There is one more test of a related nature which may 
p r 

be useful for him to understand and its explanation will be given in the 
succeeding paragraphs. . 

b_. In Par, 47d_ it was stated that two monoalphabet ic distributions when 
correctly combined will yield a single distribution which should still be mono- 
alphabetic in character. This question arises, therefore, in the student’s 
mind: is there a test whereby he can ascertain mathematically \\rhether a dis- 

tribution is monoalphabetic or not, especially in the case of one which has 
relatively few data? Such. a test has been devised and is termed "the 0 (Phi) 
test", 

51. Derivation of. the 0-test. - a_. Consider a monographic or uniliteral 

frequency distribution which is monoalphabetic in composition. If there is a 

total of N letters in the distribution, in a system in which there are n 

possible elements, then there is a possible total of N(N-l) pairs of letters 

' 2 

(for comparison purposes),. 
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b>. Let the symbol f represent :the number of occurrences of A, f_ the 
" & B 

number of occurrences of B, and so on to f, . With regard to the letter A 

othen, there are f.(f.-l) coincidences. (Again the combinations of f \ things 

. * • A . A A 

2 

taken two at a time.) With regard to the letter B, there are fg(fg-l) 

- . . . ... , 2 \ 

coincidences, and so on up to f (f -1) coincidences for the letter Z. Wow it 

/ • • . ■ Z Z . , 

2 ' 

has been seen that according to the K -test, in N(N-l) comparisons of letters 

2 

forming the two members of : pairs of letters in normal English plain text, there 

should be K N(Nri) coincidences,, where- K^,is the probability .of monographic 

coincidence for the language; in question. 

£. Now the expected value of f^(f^-l-) ,f B (f B -l) f z (f 7j -l) 

2 1 - 2 - * ' 2 " 

is equal 1 to the theoretical number of coincidences -to be expected in N(N-l) 

2 

comparisons of two letters, which for normal plain text is ' K times N(N-l) 

p 2 

and for fandom text is K times N(N-l) . That is , for, -plain text: 

r . — g 



Expected value of f A (f A ~l) f^f^-l) 



•+- 



B' B 



1 ) 






( IX) Expected value of f A ( f A ~1 ) + fg( f g-1 ) + . . ,*f z ( f 7 ~1 ) ' = ' K Jtf( N-l ) ; 



L Z'"Z 



and for random text: 



Expected value of fjtVl) + iglfg-lj . ... W 1 ) K, x U(N-l). or 



(x) Expected value of f A (f A -l) -^f^fg-l) + . . .^f z '(f 2 '-l) - K r N(.N-l ). 

If for the left-hand side of equations (IX) and (X) the symbol E( (j) ) is used, 
then these equations become: 

(XI) ... . For plain text ... E( ) s K N(N-l) 

(XII) For random text .. E( £ ) - K r N(N-l) 

Where E( (J) ) means the. average or expected value of the expression in the 
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parenthesis, K and K are the probabilities of monographic coincidence in 
P r 

plain and in random text, respectively. 

. d. . Now in normal English plain text it has been found that K - .0667. 

. - p 

For random text of a 26-letter alphabet K - .038. Therefore, equations 
(XI) and (XII ) may now be written thus: 

(XIII) For normal English plain text E( <|l ) = .0667 N(N-l) 

(XIV) For random text (26-letter alphabet) E( (f) r ) s .0385 N(N-l) 

e_. By employing equations (XIII) and, (XIV) it becomes possible, there- 
fore, to test a piece of text for monoalphabet icity or for "randomness". That 
is, by using these equations one can mathematically. test a very short crypto- 
gram to ascertain whether it is a monoalphabet ically enciphered substitution 
or involves several alphabets so that for all practical purposes it is equi- 
valent to random text. This test has been termed the (j) -test. 

52. Applying the <J)-test..- a_. Given the following short piece of text, 
is it likely that it is normal English plain text enciphered monoalphabeti- ' 
cally? 

AB CD|F |H.IULMH0|QRS T ITWXYZ N = 25 
For this case the observed value of <{) Is: 

( 1x0) -f- (1x0) + (2x1) +■ (3x2)+ ( 4x3) +- (2xl) + (1x0) +-( 4x3) ( 2x1) + (1x0) -+ (1x0)-+- 

(3x2) = 2+-6+12+2+12+2+6 = 40 

If this text were monoalphabetically enciphered English plain text the expect- 
ed value of (J). is : 

E( <h. ) - K N(N-l) - .0667 x 25 x 24 = 40.0 
r P ’ p 

If the text were random text, the expected value of 0 is: 

E( (j) r ) = K r N(N-l) = .0385 x 25 x 24 - 23.1 
The conclusion is warranted, therefore, that the cryptogram is probably mono- 
alphabetic substitution, since the observed value of (J} (40) more closely 
approximates the expected value for English plain text (40.0) than it does the 
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expected value for random text (23.1). (As a matter of fact, the cryptogram' 
was enciphered monoalphabetically. ) 

b_. Here is another example. Given the following sex'ies of letters, 
does it represent a selection of English text enciphered monoalphahetically or 
does it more nearly represent a random selection of letters? 

, I 0 U I J z ' M M Z Z ' M R N Q, C I I Y T If R G K L H 

! The distribution and calculation are as follows: 

ABpEF&H'nELINOP qESTUYIXYZ 
f(f-l)... 0 00,2 000600 02 00002a 

' ^ f ( f-1 ) - 18 (That is, observed value of <t) -18). 

E((J)^) = .0667x25x24 =' 40.0 (Thai is, expected value of = 40.0 
The conclusion is that the series of letters does not represent a selection of 
English text monoalphahetically enciphered. Whether or not it ^represents a 
random selection of letters cannot be told, but it may be said that if the 
letters actually do constitute a cryptogram, the latter is probably polyalpha- 
betically enciphered. (As a matter of fact, the latter statement is true, 

for the message was enciphered by 25 alphabets- used Mn sequence.) 

* » « • 

c_i The (j) -test is, of course, closely related to the X -test and derive 
from the same general theory as' the latter, which is that of coincidence. 

When two monoalphabet ic distributions have ' been combined into a single distri- 
bution, the (fi -test may be applied to the latter as a check upon the X -test. 
It is also useful in testing the columns of a super imposition diagram, to 
ascertain whether or not the columns are monoalphabet ic. 




REF ID:A4146453 

-.149 - 
SECTION XIII 
CONCLUDING REMARKS 



Paragraph 



Concluding remarks on aperiodic substitution systems 53 

Synoptic table 54 

53. Concluding remarks on aperiodic substitution systems. - a_. The 



various systems described in the foregoing pages represent some of the more 
common and we 11-known methods of introducing complexities in the general scheme 
of cryptographic substitution with the view to avoiding or suppressing periodi- 
city. There are, of course., other methods for . accomplishing this, purpose, 
which, while perhaps a bit. more complex from a practical point of view, , yield 
more desirable results from a cryptographic point of view. That is, these 
methods go deeper into the heart of the problem of cryptographic security and 
thus make the task of the enemy cryptanalyst much harder. . But studies based' 
on these more advanced methods .will have to be postponed at this time, and 
reserved for a later text. 

b. Thus far in these studies, aside from. a few remarks of a very general 
nature, no attention has been paid to that other large and important class of 
ciphers, viz, transposition. It is desirable, before. going further with sub- 
stitution methods , that the student gain some -understanding of how to solve 
certain of the more simple varieties of transposition ciphers. Consequently, 
in the text to succeed the present text, the student will temporarily lay aside 
the various useful methods and tools that he has been given for- the solution 
of substitution ciphers and will turn his thoughts toward the methods of break- 
ing down transposition ciphers.. 

t 

54. Synoptic table. - Continuing the plan instituted in previous texts, 
of summarizing the textual material in the form of a very condensed chart 

called An Analytical Key for Military Cryptanalysis, the outline for the 
studies covered by Part III follows herewith.. 
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Par. Pages 

Aperiodic systems lb 1 

Arithmetical' equivalent of normal sliding-strip 

encipherment 29 c. 65 

Auto-key encipherment, two basic methods of 23 46 

Auto-key systems, solution of ....... * 23-38 46-88 

Auto-key systems, characteristics of 25h-j.»38b 55-56,88 

Auto-key systems, concluding remarks on..- '• 38 88 

Auto-keying, cipher text..., 23c 46 

Auto-keying, plaintext ..;... 23b, 27 46,59 

Avoiding periodicity, methods of 1-4,17 1-8, 31 

Base letter 25j. 56 

Basic period masked by aperiodic repetitions ..... l6_c .27 

Blocking out isomorphs . 14c. 23 

Blocking out words 14a '22 

Book as key 5b 8 

Chi-test, applying the 47a 130 

Chi-test , derivation of . . . ... ........ 4 46e •. 127 

Chi-text, example of application of 48-49 132-145 

Chi-test in matching Shifted distributions ....... • ' 47d 131 

Coincidence test 41c 106 

Coincidence test, application of 43 • 110-119 

Coincidence test, basic theory of 41 101-110 

Coincidence, intermittent l6_e ;• 29 

Combining individual frequency distributions . . . I . 45g 125 

Comparisons for coincidence, .-v. 41d 106 

Constant-length, plain-text groupings 2a 2 

Continuous-key system. vi 36. 91. 

Conversion of an aperiodic cipher into periodic form 32 81-88 

Converting auto-key text to periodic terms 32 81-88 

Cross-product or X-test 46-49 125-145 

Cryptanalytic coincidence test 41-44 101-123 

Cryptographic arithmetic 29c 65 

Cryptographic periodicity, nature of ............. . 2 . 2 

Cyclic phenomena . . la 1 

Enciphering equations 9b 12 

Encipherment by word lengths 6a 9 

Extended keys ' 35 89 

Formulae, idiomorphic 10_c 14 

Frequency distribution square 48k 135 

General solution for ciphers involving- a' long . 

keying sequence 40 99 

Groupings, constant-length plain-text ............ 17-22 31-45 

Groupings, irregular. 16 26 

Groupings, variable-length, plain-text ........ . 4 . 5-16 . ' 8-30 
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Par. 



Identy or coincidence 41c 

Idiomorphism 10b 

Indicators 40b 

Influence letter.. l8e(note) 

Interlocking messages by repetitions .:40b 

Intermittent coincidences ............ ' l 6f 

Interrupting a cyclic keying sequence 18 

Interrupting the key, three basic methods of ..... 18d 

Interruptions, keying. - . 17 

Interruptor , ; -. I8d 

Interruptor, cipher text letter as 21 

Interruptor methods, disadvantages of 22e. 

Introductory key. 25h 

Introductory key consisting of more than one letter .30 

Introductory key, finding the length of the 30 

Irregular interruptions in keying sequence 17 

Isomorphic sequences . .. ..12a 

Isomorphism, illustration of the use of 13 

Isomorphism, phenomena of . 11c, Lie, 

Isomorphisms, detection of 14b 

Isomorphs, blocking out of 15b 

Kappa test 41c 

Kappa test,' application of ; . 43a 

Keying, fixed . . 2b 

Keying cycles, interaction of * . 3c 

Keying units, constant length 5-16. 

Keying units, variable length 17-22 

Keys, extended; non-repeating; running ........... 35. 

Lengthening keys 34 

Lengthy keys, systems using lc 

Lengthy keys, mechanical methods of producing .... 36d ' 
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patent; primary; resultant; secondary 4 7 

Periodicity, masked 166 27 

Periods, component 4a 7 
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Progressive .'alphabet cipher.,, solution of 



Reconstruction skeleton 

Repetitions, completely periodic 



Repetitions, partially periodic 
Repetitions,: significant 






Separators, word 



Spurious plain text. 
Statistical test.... 



Superimposition, basic principles of........ 
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